**important** Agent Connect doesn't follow the RFC 7662, but a draft
RFC, which adds security (signing/encryption) to the initial spec.
Please take a loot at the "references" part.
Concept:
This commit initiates the implementation of token introspection by
requesting the OIDC provider (OP) to validate the access token received
from the client. The access token is initially issued by the OP, passed to
the Service Provider (SP), and then forwarded to the Resource Server (RS) by
the SP.
The token introspection is done by our custom RS authentication class.
The OP is the service capable of validating the integrity of the access
token. Token introspection requests to the OP should provide authentication
and authorization information about the user currently logged in the SP,
which requests data from the RS.
Data returned by the OP to the RS are encrypted and signed.
To encrypt the introspection token, the OP retrieves DP public key from the
newly introduced endpoint '/jwks'. The encryption parameters (algorithm and
encoding) are set while configuring the RS. Please ensure that the encryption
algorithm and encoding are matching between the OP and the RS.
Token signature is verified by the RS, using OP's public key, exposed through
its '/jwks' endpoint. Please make sure the signature algorithm are matching
between the OP and the RS.
Finally, introspection token claims are validated to follow good practices while
handling JWT. Claims as issuer, audience, or expiration time are validated.
The introspection token contains a sub. RS retrieves the requested db user from
using this sub. This should work with a paiwise or a public sub.
References:
The initial RFC describing the token introspection is the RFC 7662 "Oauth 2.0
Token Introspection". However, the introspection response specified in this RFC,
is a plain JSON object
In eGovernement applications, our resource server requires a stronger assurance
that the authorization server issued the token introspection response.
France Connect's team decided to implement a stronger version of the spec, which
returns a signed and encrypted token introspection response. This stronger
version is still draft, you can find it by searching:
"draft-ietf-oauth-jwt-introspection-response"
For documentation on the token introspection flow, refer to the France
Connect documentation at the "validation token" section. It mentions both specs
but doesn't explain their choice.
Although the documentation references France Connect, it describes the
general behavior required by the draft specification, which is also supported
in Agent Connect.
