7:42 a.m.
Hi, I am getting a problem with token introspection.
My setup is Keycloak 3.2.0.Final in combination with Apache+mod_auth_openidc. I configured
mod_auth_openidc as an OAuth 2 resource server (for what it's worth, reproduced at the
bottom).
I would be very grateful if someone could have a look and point me to where to continue
working on resolving the problem. The problem
Thanks,
Manuel
I have a client "igv-files" setup and I can manually log me in for this OAuth
client:
$ curl -X POST -d client_id=igv-files -d
client_secret=030d8719-5479-4400-a8e9-185abac13cb1 -d 'username=ME(a)EXAMPLE.COM' -d
'password=MYPASS' -dgrant_type=password
https://HOST/auth/realms/REALM/protocol/openid-connect/token
Result
{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJsNEhkVVhkdGxSamhta08yVTFld0JyX2hQYlZ6OWVINkQxNXBsVklSUGo4In0.eyJqdGkiOiIzYWJiNGQ4OC1jYjI0LTRlZDktODIwZS1kMTE5ODg0NzhjZTYiLCJleHAiOjE1MDAyOTQ5MjUsIm5iZiI6MCwiaWF0IjoxNTAwMjk0NjI1LCJpc3MiOiJodHRwczovL2N1Ymktc3NvLmJpaGVhbHRoLm9yZy9hdXRoL3JlYWxtcy9iaWhlYWx0aCIsImF1ZCI6Imlndi1maWxlcyIsInN1YiI6IjhkZjczMzllLTFiYWYtNDJhMS05ZjA3LWQzYzZjNjQ3NjQ4MCIsInR5cCI6IkJlYXJlciIsImF6cCI6Imlndi1maWxlcyIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6ImFjZTYwM2ZiLWQ3MTUtNDQxMS1hNTZjLTJjZTY5YWM2NGJiMCIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cHM6Ly9jdWJpLWlndi1maWxlcy5iaWhlYWx0aC5vcmciXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwibmFtZSI6Ik1hbnVlbCBIb2x0Z3Jld2UiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJob2x0Z3Jld2UsIG1hbnVlbCIsImdpdmVuX25hbWUiOiJNYW51ZWwiLCJmYW1pbHlfbmFtZSI6IkhvbHRncmV3ZSIsImVtYWlsIjoibWFudWVsLmhvbHRncmV3ZUBiaWhlYWx0aC5kZSJ9.a6XdNMW8uEefYKq7AhPg7_LAIIkKrZ3dOKi0pulOSd3W94mV3M0uqT10JbMrxWkGmZZHPaMDLx8U0U6fwCVTsmRsOH5IyKVxfAoSAMYoaTKHZCHrWENG2EdMqy39M_7iqkf2dZasav5EAuJPgjCi6vYpfRCWHYM_5U90uJu2Hi395u7Ro0xX9jfBytf1wt-ydDyG58L6HB8hqiLzQQTBep4soYz9-NzSTMOyljnYX8wtGhYUurYtTS2OGpf3Zd5vp54v6NRZmRH7vi3PSn2kEUEmGjBt-v-r3JNB8-IhMVnW6jyLKFlzJjml3NmZ2MzZsFwYXXlRbNODtVDuDuGRFg","expires_in":300,"refresh_expires_in":1800,"refresh_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJsNEhkVVhkdGxSamhta08yVTFld0JyX2hQYlZ6OWVINkQxNXBsVklSUGo4In0.eyJqdGkiOiI5ZWQ4NDJlNS1mMWEyLTQ0MmUtYTM2Ni0xZThkZmRkZTI4Y2UiLCJleHAiOjE1MDAyOTY0MjUsIm5iZiI6MCwiaWF0IjoxNTAwMjk0NjI1LCJpc3MiOiJodHRwczovL2N1Ymktc3NvLmJpaGVhbHRoLm9yZy9hdXRoL3JlYWxtcy9iaWhlYWx0aCIsImF1ZCI6Imlndi1maWxlcyIsInN1YiI6IjhkZjczMzllLTFiYWYtNDJhMS05ZjA3LWQzYzZjNjQ3NjQ4MCIsInR5cCI6IlJlZnJlc2giLCJhenAiOiJpZ3YtZmlsZXMiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJhY2U2MDNmYi1kNzE1LTQ0MTEtYTU2Yy0yY2U2OWFjNjRiYjAiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19fQ.M0FZU-RkfjWgGbShfXC8CFfqTCG5HG4weEGPHAMovAVLqgJj8cQjodkzhQAPUQTjjyEZeeShTnMtMcbbciJ-EBwCsDonc0eDELzGO3xKuZU8yURhKB6N2yheuhuX2eU0ChMGkURhD4Iju5umbYe8sdpAzte1S9iW9dxRl8Q4fw-gLfZ5oeD5dExQClBdJUWYire8T2wwvD68OKviiZbRfh1gCM6EkhTR121L8SOvA5k22E-gSrjBa6zk5OeiTqaaNgBt_eBOWEtKZvbQZVIEVX9-5TOViIXVDGLG30Wa7a0-Zk6bsAMLt2jV4FQqt_HPIegMAD3btPAN3qZ0-0QkJg","token_type":"bearer","not-before-policy":1500291033,"session_state":"ace603fb-d715-4411-a56c-2ce69ac64bb0"}
Then, I'm trying to access a resource in Apache (reproduced below, not so important, I
think) from with I get a 401 Unauthorized reply.
The mod_auth_openidc tries to introspect the token and this is where things appear to
fail.
Here is the log entry in my apache log, showing that it POSTs to the SSO host and gets
back a failure.
[Mon Jul 17 14:38:56.287833 2017] [auth_openidc:debug] [pid 26627:tid 140542922938112]
src/oauth.c(138): [client 172.16.128.8:43630] oidc_oauth_get_bearer_token: bearer token:
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJsNEhkVVhkdGxSamhta08yVTFld0JyX2hQYlZ6OWVINkQxNXBsVklSUGo4In0.eyJqdGkiOiIzYWJiNGQ4OC1jYjI0LTRlZDktODIwZS1kMTE5ODg0NzhjZTYiLCJleHAiOjE1MDAyOTQ5MjUsIm5iZiI6MCwiaWF0IjoxNTAwMjk0NjI1LCJpc3MiOiJodHRwczovL2N1Ymktc3NvLmJpaGVhbHRoLm9yZy9hdXRoL3JlYWxtcy9iaWhlYWx0aCIsImF1ZCI6Imlndi1maWxlcyIsInN1YiI6IjhkZjczMzllLTFiYWYtNDJhMS05ZjA3LWQzYzZjNjQ3NjQ4MCIsInR5cCI6IkJlYXJlciIsImF6cCI6Imlndi1maWxlcyIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6ImFjZTYwM2ZiLWQ3MTUtNDQxMS1hNTZjLTJjZTY5YWM2NGJiMCIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cHM6Ly9jdWJpLWlndi1maWxlcy5iaWhlYWx0aC5vcmciXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwibmFtZSI6Ik1hbnVlbCBIb2x0Z3Jld2UiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJob2x0Z3Jld2UsIG1hbnVlbCIsImdpdmVuX25hbWUiOiJNYW51ZWwiLCJmYW1pbHlfbmFtZSI6IkhvbHRncmV3ZSIsImVtYWlsIjoibWFudWVsLmhvbHRncmV3ZUBiaWhlYWx0aC5kZSJ9.a6XdNMW8uEefYKq7AhPg7_LAIIkKrZ3dOKi0pulOSd3W94mV3M0uqT10JbMrxWkGmZZHPaMDLx8U0U6fwCVTsmRsOH5IyKVxfAoSAMYoaTKHZCHrWENG2EdMqy39M_7iqkf2dZasav5EAuJPgjCi6vYpfRCWHYM_5U90uJu2Hi395u7Ro0xX9jfBytf1wt-ydDyG58L6HB8hqiLzQQTBep4soYz9-NzSTMOyljnYX8wtGhYUurYtTS2OGpf3Zd5vp54v6NRZmRH7vi3PSn2kEUEmGjBt-v-r3JNB8-IhMVnW6jyLKFlzJjml3NmZ2MzZsFwYXXlRbNODtVDuDuGRFg
[Mon Jul 17 14:38:56.287980 2017] [auth_openidc:debug] [pid 26627:tid 140542922938112]
src/cache/shm.c(156): [client 172.16.128.8:43630] oidc_cache_shm_get: enter,
section="access_token",
key="eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJsNEhkVVhkdGxSamhta08yVTFld0JyX2hQYlZ6OWVINkQxNXBsVklSUGo4In0.eyJqdGkiOiIzYWJiNGQ4OC1jYjI0LTRlZDktODIwZS1kMTE5ODg0NzhjZTYiLCJleHAiOjE1MDAyOTQ5MjUsIm5iZiI6MCwiaWF0IjoxNTAwMjk0NjI1LCJpc3MiOiJodHRwczovL2N1Ymktc3NvLmJpaGVhbHRoLm9yZy9hdXRoL3JlYWxtcy9iaWhlYWx0aCIsImF1ZCI6Imlndi1maWxlcyIsInN1YiI6IjhkZjczMzllLTFiYWYtNDJhMS05ZjA3LWQzYzZjNjQ3NjQ4MCIsInR5cCI6IkJlYXJlciIsImF6cCI6Imlndi1maWxlcyIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6ImFjZTYwM2ZiLWQ3MTUtNDQxMS1hNTZjLTJjZTY5YWM2NGJiMCIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cHM6Ly9jdWJpLWlndi1maWxlcy5iaWhlYWx0aC5vcmciXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwibmFtZSI6Ik1hbnVlbCBIb2x0Z3Jld2UiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJob2x0Z3Jld2UsIG1hbnVlbCIsImdpdmVuX25hbWUiOiJNYW51ZWwiLCJmYW1pbHlfbmFtZSI6IkhvbHRncmV3ZSIsImVtYWlsIjoibWFudWVsLmhvbHRncmV3ZUBiaWhlYWx0aC5kZSJ9.a6XdNMW8uEefYKq7AhPg7_LAIIkKrZ3dOKi0pulOSd3W94mV3M0uqT10JbMrxWkGmZZHPaMDLx8U0U6fwCVTsmRsOH5IyKVxfAoSAMYoaTKHZCHrWENG2EdMqy39M_7iqkf2dZasav5EAuJPgjCi6vYpfRCWHYM_5U90uJu2Hi395u7Ro0xX9jfBytf1wt-ydDyG58L6HB8hqiLzQQTBep4soYz9-NzSTMOyljnYX8wtGhYUurYtTS2OGpf3Zd5vp54v6NRZmRH7vi3PSn2kEUEmGjBt-v-r3JNB8-IhMVnW6jyLKFlzJjml3NmZ2MzZsFwYXXlRbNODtVDuDuGRFg"
[Mon Jul 17 14:38:56.290061 2017] [auth_openidc:debug] [pid 26627:tid 140542922938112]
src/util.c(600): [client 172.16.128.8:43630] oidc_util_http_post_form: post
data="token_type_hint=requesting_party_token&token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJsNEhkVVhkdGxSamhta08yVTFld0JyX2hQYlZ6OWVINkQxNXBsVklSUGo4In0.eyJqdGkiOiIzYWJiNGQ4OC1jYjI0LTRlZDktODIwZS1kMTE5ODg0NzhjZTYiLCJleHAiOjE1MDAyOTQ5MjUsIm5iZiI6MCwiaWF0IjoxNTAwMjk0NjI1LCJpc3MiOiJodHRwczovL2N1Ymktc3NvLmJpaGVhbHRoLm9yZy9hdXRoL3JlYWxtcy9iaWhlYWx0aCIsImF1ZCI6Imlndi1maWxlcyIsInN1YiI6IjhkZjczMzllLTFiYWYtNDJhMS05ZjA3LWQzYzZjNjQ3NjQ4MCIsInR5cCI6IkJlYXJlciIsImF6cCI6Imlndi1maWxlcyIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6ImFjZTYwM2ZiLWQ3MTUtNDQxMS1hNTZjLTJjZTY5YWM2NGJiMCIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cHM6Ly9jdWJpLWlndi1maWxlcy5iaWhlYWx0aC5vcmciXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwibmFtZSI6Ik1hbnVlbCBIb2x0Z3Jld2UiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJob2x0Z3Jld2UsIG1hbnVlbCIsImdpdmVuX25hbWUiOiJNYW51ZWwiLCJmYW1pbHlfbmFtZSI6IkhvbHRncmV3ZSIsImVtYWlsIjoibWFudWVsLmhvbHRncmV3ZUBiaWhlYWx0aC5kZSJ9.a6XdNMW8uEefYKq7AhPg7_LAIIkKrZ3dOKi0pulOSd3W94mV3M0uqT10JbMrxWkGmZZHPaMDLx8U0U6fwCVTsmRsOH5IyKVxfAoSAMYoaTKHZCHrWENG2EdMqy39M_7iqkf2dZasav5EAuJPgjCi6vYpfRCWHYM_5U90uJu2Hi395u7Ro0xX9jfBytf1wt-ydDyG58L6HB8hqiLzQQTBep4soYz9-NzSTMOyljnYX8wtGhYUurYtTS2OGpf3Zd5vp54v6NRZmRH7vi3PSn2kEUEmGjBt-v-r3JNB8-IhMVnW6jyLKFlzJjml3NmZ2MzZsFwYXXlRbNODtVDuDuGRFg"
[Mon Jul 17 14:38:56.290182 2017] [auth_openidc:debug] [pid 26627:tid 140542922938112]
src/util.c(427): [client 172.16.128.8:43630] oidc_util_http_call:
url=https://SSOHOST.org/auth/realms/REALM/protocol/openid-connect/token/i...,
data=token_type_hint=requesting_party_token&token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJsNEhkVVhkdGxSamhta08yVTFld0JyX2hQYlZ6OWVINkQxNXBsVklSUGo4In0.eyJqdGkiOiIzYWJiNGQ4OC1jYjI0LTRlZDktODIwZS1kMTE5ODg0NzhjZTYiLCJleHAiOjE1MDAyOTQ5MjUsIm5iZiI6MCwiaWF0IjoxNTAwMjk0NjI1LCJpc3MiOiJodHRwczovL2N1Ymktc3NvLmJpaGVhbHRoLm9yZy9hdXRoL3JlYWxtcy9iaWhlYWx0aCIsImF1ZCI6Imlndi1maWxlcyIsInN1YiI6IjhkZjczMzllLTFiYWYtNDJhMS05ZjA3LWQzYzZjNjQ3NjQ4MCIsInR5cCI6IkJlYXJlciIsImF6cCI6Imlndi1maWxlcyIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6ImFjZTYwM2ZiLWQ3MTUtNDQxMS1hNTZjLTJjZTY5YWM2NGJiMCIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cHM6Ly9jdWJpLWlndi1maWxlcy5iaWhlYWx0aC5vcmciXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwibmFtZSI6Ik1hbnVlbCBIb2x0Z3Jld2UiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJob2x0Z3Jld2UsIG1hbnVlbCIsImdpdmVuX25hbWUiOiJNYW51ZWwiLCJmYW1pbHlfbmFtZSI6IkhvbHRncmV3ZSIsImVtYWlsIjoibWFudWVsLmhvbHRncmV3ZUBiaWhlYWx0aC5kZSJ9.a6XdNMW8uEefYKq7AhPg7_LAIIkKrZ3dOKi0pulOSd3W94mV3M0uqT10JbMrxWkGmZZHPaMDLx8U0U6fwCVTsmRsOH5IyKVxfAoSAMYoaTKHZCHrWENG2EdMqy39M_7iqkf2dZasav5EAuJPgjCi6vYpfRCWHYM_5U90uJu2Hi395u7Ro0xX9jfBytf1wt-ydDyG58L6HB8hqiLzQQTBep4soYz9-NzSTMOyljnYX8wtGhYUurYtTS2OGpf3Zd5vp54v6NRZmRH7vi3PSn2kEUEmGjBt-v-r3JNB8-IhMVnW6jyLKFlzJjml3NmZ2MzZsFwYXXlRbNODtVDuDuGRFg,
content_type=application/x-www-form-urlencoded,
basic_auth=igv-files:030d8719-5479-4400-a8e9-185abac13cb1, bearer_token=(null),
ssl_validate_server=1
[Mon Jul 17 14:38:56.373267 2017] [auth_openidc:debug] [pid 26627:tid 140542922938112]
src/util.c(551): [client 172.16.128.8:43630] oidc_util_http_call:
response={"error":"invalid_request","error_description":"Failed
to introspect token."}
[Mon Jul 17 14:38:56.374242 2017] [auth_openidc:error] [pid 26627:tid 140542922938112]
[client 172.16.128.8:43630] oidc_util_json_string_print: oidc_util_check_json_error:
response contained an "error" entry with value:
""invalid_request""
[Mon Jul 17 14:38:56.374409 2017] [auth_openidc:error] [pid 26627:tid 140542922938112]
[client 172.16.128.8:43630] oidc_util_json_string_print: oidc_util_check_json_error:
response contained an "error_description" entry with value: ""Failed
to introspect token.""
And here is the log entry of the wildfly/keycloak showing the failure:
2017-07-17 14:40:43,769 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default
task-25) new JtaTransactionWrapper
2017-07-17 14:40:43,780 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default
task-25) was existing? false
2017-07-17 14:40:43,781 DEBUG [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-25)
RESTEASY002315: PathInfo: /realms/REALM/protocol/openid-connect/token/introspect
2017-07-17 14:40:43,788 DEBUG [org.keycloak.authentication.AuthenticationProcessor]
(default task-25) AUTHENTICATE CLIENT
2017-07-17 14:40:43,795 DEBUG [org.keycloak.authentication.ClientAuthenticationFlow]
(default task-25) client authenticator: client-secret
2017-07-17 14:40:43,797 DEBUG [org.keycloak.authentication.ClientAuthenticationFlow]
(default task-25) client authenticator SUCCESS: client-secret
2017-07-17 14:40:43,797 DEBUG [org.keycloak.authentication.ClientAuthenticationFlow]
(default task-25) Client igv-files authenticated by client-secret
2017-07-17 14:40:43,797 DEBUG
[org.keycloak.authorization.protection.introspect.RPTIntrospectionProvider] (default
task-25) Introspecting requesting party token
2017-07-17 14:40:43,800 WARN [org.keycloak.events] (default task-25)
type=INTROSPECT_TOKEN_ERROR, realmId=bihealth, clientId=igv-files, userId=null,
ipAddress=172.16.96.165, error=invalid_request, detail='Failed to introspect
token.', client_auth_method=client-secret
2017-07-17 14:40:43,802 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default
task-25) JtaTransactionWrapper commit
2017-07-17 14:40:43,811 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default
task-25) JtaTransactionWrapper end
## mod_auth_openidc configuration
OIDCOAuthClientID igv-files
OIDCOAuthClientSecret 030d8719-5479-4400-a8e9-185abac13cb1
OIDCOAuthIntrospectionEndpoint
https://SSOHOST.org/auth/realms/REALM/protocol/openid-connect/token/intro...
OIDCOAuthIntrospectionEndpointAuth client_secret_basic
OIDCOAuthIntrospectionEndpointMethod POST
OIDCOAuthIntrospectionEndpointParams token_type_hint=requesting_party_token
OIDCOAuthIntrospectionTokenParamName token
<Location />
Authtype oauth20
Require valid-user
LogLevel debug
</Location>
# Resource Query for Apache
# curl -I --header "Authorization: Bearer
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJsNEhkVVhkdGxSamhta08yVTFld0JyX2hQYlZ6OWVINkQxNXBsVklSUGo4In0.eyJqdGkiOiIzYWJiNGQ4OC1jYjI0LTRlZDktODIwZS1kMTE5ODg0NzhjZTYiLCJleHAiOjE1MDAyOTQ5MjUsIm5iZiI6MCwiaWF0IjoxNTAwMjk0NjI1LCJpc3MiOiJodHRwczovL2N1Ymktc3NvLmJpaGVhbHRoLm9yZy9hdXRoL3JlYWxtcy9iaWhlYWx0aCIsImF1ZCI6Imlndi1maWxlcyIsInN1YiI6IjhkZjczMzllLTFiYWYtNDJhMS05ZjA3LWQzYzZjNjQ3NjQ4MCIsInR5cCI6IkJlYXJlciIsImF6cCI6Imlndi1maWxlcyIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6ImFjZTYwM2ZiLWQ3MTUtNDQxMS1hNTZjLTJjZTY5YWM2NGJiMCIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cHM6Ly9jdWJpLWlndi1maWxlcy5iaWhlYWx0aC5vcmciXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwibmFtZSI6Ik1hbnVlbCBIb2x0Z3Jld2UiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJob2x0Z3Jld2UsIG1hbnVlbCIsImdpdmVuX25hbWUiOiJNYW51ZWwiLCJmYW1pbHlfbmFtZSI6IkhvbHRncmV3ZSIsImVtYWlsIjoibWFudWVsLmhvbHRncmV3ZUBiaWhlYWx0aC5kZSJ9.a6XdNMW8uEefYKq7AhPg7_LAIIkKrZ3dOKi0pulOSd3W94mV3M0uqT10JbMrxWkGmZZHPaMDLx8U0U6fwCVTsmRsOH5IyKVxfAoSAMYoaTKHZCHrWENG2EdMqy39M_7iqkf2dZasav5EAuJPgjCi6vYpfRCWHYM_5U90uJu2Hi395u7Ro0xX9jfBytf1wt-ydDyG58L6HB8hqiLzQQTBep4soYz9-NzSTMOyljnYX8wtGhYUurYtTS2OGpf3Zd5vp54v6NRZmRH7vi3PSn2kEUEmGjBt-v-r3JNB8-IhMVnW6jyLKFlzJjml3NmZ2MzZsFwYXXlRbNODtVDuDuGRFg"
https://FILESHOST/PATH
1:58 a.m.
Hi,
On 07/17/2017 02:42 PM, Holtgrewe, Manuel wrote:
OIDCOAuthIntrospectionEndpointParams
token_type_hint=requesting_party_token
If you're doing a token introspection of an access token the
token_type_hint should be `access_token` as per RFC.
See the documentation:
https://github.com/keycloak/keycloak-documentation/blob/3.2.0.Final/secur...
From the RFC
The following is a non-normative example request:
POST /introspect HTTP/1.1
Host: server.example.com
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
token=mF_9.B5f-4.1JqM&token_type_hint=access_token
I have a some sample code in a test case:
https://github.com/iperdomo/keycloak-oauth2-instrospection/blob/master/te...
I hope this helps.
--
Iván
2:43 a.m.
Thanks, that did the trick!
--
Dr. Manuel Holtgrewe
Bioinformatician
Core Unit Bioinformatics – CUBI
Berlin Institute of Health / Max Delbrück Center for Molecular Medicine in the Helmholtz
Association / Charité – Universitätsmedizin Berlin
Visiting Address: Invalidenstr. 80, 3rd Floor, Room 03 028, 10117 Berlin
Postal Address: Chariteplatz 1, 10117 Berlin
E-Mail: manuel.holtgrewe(a)bihealth.de
Phone: +49 30 450 543 607
Fax: +49 30 450 7 543 901
Web: cubi.bihealth.org www.bihealth.org www.mdc-berlin.de www.charite.de
________________________________________
From: keycloak-user-bounces(a)lists.jboss.org [keycloak-user-bounces(a)lists.jboss.org] on
behalf of Iván Perdomo [ivan(a)akvo.org]
Sent: Tuesday, July 18, 2017 08:58
To: keycloak-user(a)lists.jboss.org
Subject: Re: [keycloak-user] "Failed to introspect token" problem
Hi,
On 07/17/2017 02:42 PM, Holtgrewe, Manuel wrote:
OIDCOAuthIntrospectionEndpointParams
token_type_hint=requesting_party_token
If you're doing a token introspection of an access token the
token_type_hint should be `access_token` as per RFC.
See the documentation:
https://github.com/keycloak/keycloak-documentation/blob/3.2.0.Final/secur...
From the RFC
The following is a non-normative example request:
POST /introspect HTTP/1.1
Host: server.example.com
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
token=mF_9.B5f-4.1JqM&token_type_hint=access_token
I have a some sample code in a test case:
https://github.com/iperdomo/keycloak-oauth2-instrospection/blob/master/te...
I hope this helps.
--
Iván
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
3096
days inactive
3097
days old
2 comments
2 participants
participants (2)
-
Holtgrewe, Manuel -
Iván Perdomo