Support for opaque access tokens

[Magne Bratseth]

Hi

I am trying to use Elytron OIDC to authenticate users, using different identity providers.
But as others have already commented, and the issue https://issues.redhat.com/browse/ELY-2202 states, Elytron assumes the access token is always a valid JWT.

I am not sure what the best way to add support for opaque access tokens is. But I am willing to spend some time coding and submitting a pull request if someone can guide me to what the proper solution would be. For my case (only authentication), a simple approach with an configuration option to either skip the access token or not fail if it is not a valid JWT would be enough.

Best regards,
Magne

[Diana Krepinska]

Hello Magne,

Thank you for interest!  We will look into what the implementation for opaque access token validation would entail and I will get back to you with further details.

[Diana Krepinska]

Hello Magne,

Adding support for opaque access tokens requires the addition of introspection endpoint calls to verify that the opaque token is active and to retrieve the relevant information. The implementation for this would be added to the module here . Some relevant access token processing for cases when the token is JWT can be seen here.

The implementation requires adding a new option to the oidc.json to be able to configure an introspection endpoint URL.

Please let us know if you have any questions,

Thanks!

[Magne Bratseth]

Hello Diana,

I will start looking at this soon. Thanks for the pointers.

Best regards,
Magne

[Magne Bratseth]

Hi,

I have started looking at the code and gathering some more details about the introspection endpoints and their use. But I have hit a bit of a snag.

Neither of the two identity providers I am tasked with supporting (Google and Oauth0) have an introspection endpoint, so that is unfortunate.
Also, when investigating, I read that access tokens should only be used when calling APIs and not by the application itself. So for me it seems that we shouldn't even be checking the access token when authenticating users, or am I missing something here?
I guess the way that it works now may be specific for Keycloak?

Best regards,
Magne

[Diana Krepinska]

Hi Magne,

I am very sorry about my late response. If the access token is meant to be used with WF as the recipient, there is a need a way to validate it. A different use case is if the Google's opaque access token is meant to be used with google's APIs, then we might not need to do a validation with the introspection endpoint. So maybe there could be a setting to configure whether the introspection should take place.