token introspect remove client id constraint #363
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@danj3 Thanks for the PR. I agree with your understanding of the RFC. A valid token issued to any client should return a successful response. However, this function is used in many places as a validation for a specific client. We therefore can't change the behavior without making it a breaking change. A major release would have to entail refreshing all certifications which is a considerable amount of work. For this change only, I don't think it is benefit enough. I therefore propose the following:
|
|
@maennchen I think this follows the option route you had in mind. I did use a different option name, not intentionally, but may be more exact. Added tests for these scenarios as well. |
maennchen
reviewed
Aug 7, 2024
maennchen
reviewed
Aug 7, 2024
added 2 commits
August 24, 2024 19:29
previously could only introspect a client_id's own token, introspect needs to be able to introspect any token for an issuer.
add client_self_only option with default of true to require client_id match of self client_id and token client_id when false, disables match and returns only introspect result.
maennchen
force-pushed
the
introspect-client
branch
from
eb798ca
to
823c408
Compare
maennchen
previously approved these changes
Aug 24, 2024
maennchen
force-pushed
the
introspect-client
branch
from
823c408
to
fbab9ed
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
resolves #364
previously could only introspect a client_id's own token, introspect needs to be able to introspect any token for an issuer.
It is my understanding from https://datatracker.ietf.org/doc/html/rfc7662 that introspect endpoint is valid for use with any token from the issuer, however the code prior to this change would reject a token when the client_id in the token was not the same as the client_id of the caller to introspect.