Add Support for [RFC 6750] Bearer Token Usage (a.k.a. Opaque Tokens)

[dfcoffin]

Expected Behavior

Current Behavior

Context

[jgrandja]

Closing as duplicate of #52

[dfcoffin]

#52 Implements RFC 7662 OAuth 2.0 Token Introspection.

This specification defines a method for a protected resource to query
an OAuth 2.0 authorization server to determine the active state of an
OAuth 2.0 token and to determine meta-information about this token.
OAuth 2.0 deployments can use this method to convey information about
the authorization context of the token from the authorization server
to the protected resource.

RFC 6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage

This specification describes how to use bearer tokens in HTTP
requests to access OAuth 2.0 protected resources. Any party in
possession of a bearer token (a "bearer") can use it to get access to
the associated resources (without demonstrating possession of a
cryptographic key). To prevent misuse, bearer tokens need to be
protected from disclosure in storage and in transport.

Release 0.0.1 only supports JWT Tokens based on the release notes.

[jgrandja]

@dfcoffin The purpose of the Bearer Token Usage RFC 6750 is to specify how a client can use a bearer token when requesting a protected resource. The 3 options are header, form parameter and query parameter. The bearer token can be either opaque or self-contained (JWT). This spec is specific to the client.

The Token Introspection RFC 7662, specifies how a protected resource can introspect an opaque access token to determine the claims associated with the opaque access token in order to make an authorization decision. The authorization server will grant an opaque access token to the client and then the client will call the resource server, which in turn will call the authorization server's introspection endpoint to return the claims associated with the access token and apply the authorization. So the bottom line is that #52 will deliver opaque token support.

Hope all this makes sense?

[dfcoffin]

Does Release 0.0.1 support the generation of JWT and Opaque Tokens? If not what currently listed tasks will produce an opaque access token?