How-to: Use third-party opaque tokens for authentication.

[jacko9et]

My current project needs to use third-party authentication, and the other party is not compatible with oauth2, but it can obtain an opaque token, and through the opaque token, user information can be obtained.
Is it possible to give an example in this case.

[jgrandja]

@lu-cheng I don't understand your use case. Can you provide more details? What authentication system are you using and looking to integrate with Spring Authorization Server?

[jacko9et]

@jgrandja Sorry for late. There is an old system that directly returns an opaque token to the front end after logging in, and provides a userInfo interface to obtain user information. This is similar to introspection of opaque tokens. I need to do user authentication in Spring Authorization Server with something like introspection using opaque tokens. It is hoped that an opaque token can be carried in the /authorize request for user authentication.

[jgrandja]

@lu-cheng Regarding...

I need to do user authentication in Spring Authorization Server

User Authentication is not a responsibility of Spring Authorization Server. Instead, you would use Spring Security to configure the Authentication mechanism and associated integration with the backing IdP.

The only requirement of Spring Authorization Server is that the current request must be authenticated in order to proceed with certain flows, for example, authorization_code grant flow. This is simply determined by checking SecurityContext.getAuthentication().isAuthenticated(). How the Authentication instance is populated in the SecurityContext is determined how you configure the authentication mechanism within Spring Security.

I would recommend reviewing the reference manual by first going over the Authentication options and I think the Pre-Authentication Scenario might be applicable to your use case.

[jacko9et]

@jgrandja Thanks, I'll try the solution in #797 to fix this. By the way, since SecurityContext is already used, why not directly use the extension of SecurityContextRepository to handle the functionality of OAuth2AuthorizationService?