java - Apache oltu Oauth2 token 验证

Question

我需要使用 Apache oltu 代码验证由 oauth .NET 应用程序生成的 token :

OAuthClientRequest oAuthRequest = OAuthClientRequest                        
.tokenLocation("https://URL/idp/connect/identitytokenvalidation")
.setClientId("CLIENTID")        
.setGrantType(GrantType.REFRESH_TOKEN)
.setParameter("token", oauthToken)
.setScope("openid info")
.buildQueryMessage();

OAuthClient oAuthClient = new OAuthClient(new URLConnectionClient());

OAuthAccessTokenResponse oAuthResponse = oAuthClient.accessToken(oAuthRequest, OAuth.HttpMethod.GET);   

它似乎工作正常，因为我从服务器收到回复(它确认 token 有效或无效)但它不是预期的回复。我们的身份服务器以这种方式回复:

auth_time=1439911238, exp=1439911599, sub=300a3657-62f4-4d34-8c60-2c8696780abe, null, null, at_hash=jb6EW9ZgDm60aL573No4sw, null, null, nbf=1439911239, null, null, idp=idsrv, null, iat=1439911239, null, amr=password

但是 OAuthAccessTokenResponse validator 提出了一个问题，因为它似乎需要一个 token ，就像这个:

{
  "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJub25jZSI6IjE0Mzk5MTIxNTI4MjMwLjM0NTUyOTg3MjkyNDA4OTQzIiwiaWF0IjoxNDM5OTEyMTUyLCJhdF9oYXNoIjoiWlItaGlwcGh6YUctSlhkVGRnZTZwQSIsInN1YiI6IjMwMGEzNjU3LTYyZjQtNGQzNC04YzYwLTJjODY5Njc4MGFiZSIsImFtciI6InBhc3N3b3JkIiwiYXV0aF90aW1lIjoxNDM5OTExMjM4LCJpZHAiOiJpZHNydiIsImlzcyI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwIiwiYXVkIjoiaGVhbHRoY29ubmVjdGVkcG9ydGFsIiwiZXhwIjoxNDM5OTEyNTEyLCJuYmYiOjE0Mzk5MTIxNTJ9.MwbkGL85MHookJxqPv9fgae9qZ4iMJiENrY-eaIkC1wqTLuCunpeyNfV88mQZtpkbF3dk8S4uEg2UhhnGjQb-16xFUBf2zujdOujTCPV622k1xrhe3Cs9zsyY0EF4R1wTpNs_kkuMnJgaIeAgzrFki9t6G2QKMrGlcnSPr_UVRhL5KAkX3aWDBDrDGMaDPBVVU8jYV-oK5S4NExFAayWm1d0wXraWVNVcCyRQMDvZB1Jh0rqNcNhMg8EPV0LngZYSqicvyMTKv2eryBVX7sT8MUEi56vgLm-2bl6YWAGcZKSShpmBR3vDMzuuLOiBE9TrSQeu01hWJZEpgAhBu5qsA",
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJjbGllbnRfaWQiOiJoZWFsdGhjb25uZWN0ZWRwb3J0YWwiLCJzY29wZSI6WyJvcGVuaWQiLCJlbWFpbCIsImhyYXVzZXIiLCJkaGNpbmZvIiwiaHJhaW5mbyJdLCJzdWIiOiIzMDBhMzY1Ny02MmY0LTRkMzQtOGM2MC0yYzg2OTY3ODBhYmUiLCJhbXIiOiJwYXNzd29yZCIsImF1dGhfdGltZSI6MTQzOTkxMTIzOCwiaWRwIjoiaWRzcnYiLCJpc3MiOiJodHRwczovL3VhdC5tZWRpcmVzb3VyY2UuY29tL2hjL2lkcCIsImF1ZCI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwL3Jlc291cmNlcyIsImV4cCI6MTQzOTkxMjUxMiwibmJmIjoxNDM5OTEyMTUyfQ.DIqn3JaMziDQXSfAkGDyMT5Loa7HaNvhTnxywq5UTWnnqU6Zhu2yFgWvx73-i0W9ikX30askFmMKvPX0cKnVCFj2ri_jp-F4buJe2m1-3z_ZkMlX38zgthsaifbuvGACba2AlHutvxjhhsPnoTxa6R1qMsPGaEduhD6siPOtUFGFrGVqxOYssSHHX0EX2-AUj41dZTADnuInQwlWraaGPAJCLoCI3Ww1BY5wz9-5Eo6pfXtCZFABZL30TVxfvsXZaTrPWgw-WjhEnG0otFtvVAtjN0z4N-0NhISu-dcoX2KhOU26ckp1XC9xiK8sP-6OC0Bf-1Ecrep3Y_uDCOnBRw",
  "token_type": "Bearer",
  "expires_in": "360",
  "scope": "openid info",
  "state": "14399121528230.34552987292408943",
  "session_state": "1hTuAWL5A_Aj-sGFjpFACF4OI-gnyUEgnxcvImTavtw.0fb69b197f167119b7ab2362882938d8"
}

有什么线索吗？验证 token 的 url 使用 GET，以便能够使用此方法发送调用，我需要接受作为回复 OAuthAccessTokenResponse。

我是不是漏掉了什么？
安德里亚

Answer 1

OAuth 2.0 token 的验证方式尚未标准化。正在进行的工作是:https://datatracker.ietf.org/doc/html/draft-ietf-oauth-introspection-11这意味着您的验证实现与您的身份服务器不兼容。

编辑:这项工作在 https://www.rfc-editor.org/rfc/rfc7662 中被标准化