Support opaque access tokens

Not entirely sure this is an issue with this starter but can't figure out how to get this work. So I log in to my web (springboot) app (using okta authorization code flow), then I "Clear User Sessions" from Okta's developer console UI, which is supposed to revoke all existing tokens. However, this user is able to continue using the app using the same token. I'd expect the app to redirect to the login page again.

Googling on this a little bit, I ran into a post suggesting setting this property okta.oauth2.localTokenValidation to false which didn't do anything, and I actually don't see this property listed at all in com.okta.spring.boot.oauth.config.OktaOAuth2Properties in the 1.0.1-SNAPSHOT version so it was perhaps removed.

I am guessing the app is not re-validating the token with the OKTA server on every request? Is that what's going on? Isn't that the default behavior?

Using SpringBoot 2.1.1.RELEASE, okta starter 1.0.1-SNAPSHOT

[bdemers]

The current version of Spring Security only has support for local token validation.

Are you building a Resource Server. There is and open Spring Sec issue for this, but i don’t ave it handy

Thanks @bdemers . I guess we could implement a "filter" or (something like that), that "validates" the token using the "introspect?" endpoint on the authorization server? Are you aware of an example doing this? I'll do some digging too If you think I am on the right track here. Thanks again.

[bdemers]

Hey @cah-calixtomelean, it doesn't look like official support is that far away:
spring-projects/spring-security#6352
You might be able to grab something from that PR

it looks like Okta's authorization server implementation of the /introspect endpoint rejects the request if the entity making the call is not the same client (client_id) that the token was issued to. It throws an "invalid_client" error. I guess I am not sure how resource servers would be able to introspect a token then. In the flow I am testing, the token was issued to the web app client that is calling the resource server, and the web app calls the resource server using that token. The resource server fails to introspect the token due to the above.

[bdemers]

This is expected, see: https://tools.ietf.org/html/rfc7662#section-2.1

To prevent token scanning attacks, the endpoint MUST also require
some form of authorization to access this endpoint, such as client
authentication as described in OAuth 2.0 [RFC6749] ...

I agree credentials should be presented for authorization, but don't have to be the credentials of the client the token was issued to. The resource server is going to send over its client id and secret, not the client's credentials (which it has no way to know of). Seeing the code in that PR you linked for the IntrospectionAuthenticationProvider, that's what I believe it's going to do. And I don't see it working with Okta's server.

[bdemers]

You could also use the userinfo endpoint with the AccessToken as Bearer auth

[Shubham6542]

But I want to validate id_token in that case I need to /introspect and it is not working in spring boot.

[bdemers]

@Shubham6542 can you explain what you mean by this?

[Shubham6542]

@bdemers I have id token which i got form okta org authorization server. I want to validate it in my resource server side which is a spring boot application. Since, this token does not belongs to custom authorization server. So, i can't be able to validate it locally. Therefore, I am using /introspect endpoint to validate this.

My application.properties:
security.oauth2.client.clientId=0oa57fbt3r5I638u94x6
security.oauth2.resource.tokenInfoUri= https://navi-2020.okta.com/oauth2/v1/introspect

Dependencies:

org.springframework.security.oauth.boot
spring-security-oauth2-autoconfigure
2.0.0.RELEASE

While doing this, I am not getting the validation response. What are the dependencies I should use for the proper validation of token using /introspect in spring boot application?
Please help

Thank you
Note: I don't have client_secret(as it is SPA)

[bdemers]

@Shubham6542 you probably shouldn't be using the ID Token, but instead use the Access Token.

Ideally, you want to switch to using the newer Spring's newer OAuth library:
https://github.com/spring-projects/spring-security/wiki/OAuth-2.0-Migration-Guide

This project just sits on top of that, but you can use it directly as well)

[Shubham6542]

@bdemers Thanx. Actually, I am using Okta org authorization server. So, to get group claims, I need id token. I can't get group claim in access token. So, I need to validate id token in my spring boot application.
Can you please be more specific what should I do, as I am beginner?

Thank you

[bdemers]

@Shubham6542 you can configure your authorization server to return the group claim for access tokens too.