... I think you need to use basic authentication with client credentials for the token introspection endpoint.
KC_REALM=your-realm
KC_USERNAME=a-realm-user
KC_PASSWORD=a-realm-user-password
KC_CLIENT=a-test-client
KC_CLIENT_SECRET=a-test-client-credental
KC_CONTEXT=auth
# Request Tokens for credentials
KC_RESPONSE=$( \
curl -k -v -X POST \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "username=$KC_USERNAME" \
-d "password=$KC_PASSWORD" \
-d 'grant_type=password' \
-d "client_id=$KC_CLIENT" \
-d "client_secret=$KC_CLIENT_SECRET" \
"http://$KC_SERVER/$KC_CONTEXT/realms/$REALM/protocol/openid-connect/token" \
| jq .
)
KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
KC_ID_TOKEN=$(echo $KC_RESPONSE| jq -r .id_token)
KC_REFRESH_TOKEN=$(echo $KC_RESPONSE| jq -r .refresh_token)
# Show all keycloak env variables
set | grep KC_*
# Introspect Keycloak Request Token
curl -k -v \
-X POST \
-u "$KC_CLIENT:$KC_CLIENT_SECRET" \
-d "token=$KC_ACCESS_TOKEN" \
"http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token/introspect" | jq .
{
"jti": "xxxx",
"exp": 1461170489,
"nbf": 0,
"iat": 1461170189,
"aud": "test-client",
"sub": "xxxxx",
"typ": "Bearer",
"azp": "test-client",
"session_state": "xxxx",
"name": "Theo Tester",
"given_name": "Theo",
"family_name": "Tester",
"preferred_username": "xxx",
"email": "tester@localhost",
"client_session": "xxxx",
"allowed-origins": [],
"resource_access": {
"account": {
"roles": [
"manage-account",
"view-profile"
]
}
},
"client_id": "test-client",
"username": "xxx",
"active": true
}