How to implement token verification via token introspection endpoint in Spring Boot?

Question

We need to implement this endpoint as we have a number of micro services that need to verify the token.

According to this link we can use this to return some user details as well as verifying the token.

I went through spring documentation but couldn't find anything. How can we implement that so that any request automatically makes a call to introspection endpoint. I am asking this here because I'd like to hear people's experience and suggestions with this.

Answer 1

Okay, after digging Spring source code and documentation, I think I have found the answer and I am posting it here just in case anyone has the same question.

Spring has an endpoint named /check_token. From what I can see in CheckTokenEndpoint class, it is designed as per OAuth2 Token Introspection Endpoint: the only parameter of the endpoint is 'token'.

So first thing is to let the endpoint to be accessible:

@Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    security.checkTokenAccess("isAuthenticated()").tokenKeyAccess("permitAll()").passwordEncoder(passwordEncoder());
}

As you can see checkTokenAccess() lets any authenticated request to access it. Don't use permitAll()

Now in your micro-services or any application that you need to make a call to this endpoint, you will need to configure RemoteTokenServices:

@Bean
@Conditional(IfCheckTokenIsEnabled.class)
public ResourceServerTokenServices createResourceServerTokenServices() {
    RemoteTokenServices tokenServices = new RemoteTokenServices();
    tokenServices.setCheckTokenEndpointUrl("http://localhost:8099/oauth/check_token");
    tokenServices.setClientId("my_client_id");
    tokenServices.setClientSecret("client_secret"); //cannot be null

    return tokenServices;
}

That's it!

However, I found that this endpoint is not really as per the spec. In OAuth2 it has mentioned that the node 'active' of type boolean is mandatory in the response while this endpoint basically extracts the access token. You can, however, create your own endpoint and just configure RemoteTokenServices for Spring to make the call