DMC/scipro
7
0
Fork 0
Code Issues30 Pull Requests3 Actions Projects1 Releases Wiki Activity

Use OAuth 2.0 Token Introspection during log in #141

Merged
niat8586 merged 1 commits from token-introspection-login into develop 2025-03-25 08:45:26 +01:00
Conversation 5 Commits 1 Files Changed 4 +60 -2
ansv7779 commented 2025-03-24 23:08:38 +01:00
Owner

Currently, it uses an endpoint similar to OpenID Connect UserInfo but with some differences. The endpoint does not require the "openid" scope for example. There is an ongoing effort to replace the OAuth 2.0 authorization server with a more standard compliant one which would break the endpoint (since it would require the "openid" scope). It is currently not possible to request the "openid" scope to future-proof since Spring would act differently if that scope is present and assume full OpenID Connect. That leads to requiring an id token to have been issued which the current authorization server does not do.

To get around this the implementation is changed to use a standard compliant Token Introspection endpoint to get access to the subject of the access token (which is the only part that's necessary right now). Since the endpoint is standard compliant it will work with any future authorization server.

It may be necessary to run docker compose up --build to get the latest version of the Toker containers.

Currently, it uses an endpoint similar to OpenID Connect UserInfo but with some differences. The endpoint does not require the "openid" scope for example. There is an ongoing effort to replace the OAuth 2.0 authorization server with a more standard compliant one which would break the endpoint (since it would require the "openid" scope). It is currently not possible to request the "openid" scope to future-proof since Spring would act differently if that scope is present and assume full OpenID Connect. That leads to requiring an id token to have been issued which the current authorization server does not do. To get around this the implementation is changed to use a standard compliant Token Introspection endpoint to get access to the subject of the access token (which is the only part that's necessary right now). Since the endpoint is standard compliant it will work with any future authorization server. It may be necessary to run `docker compose up --build` to get the latest version of the Toker containers.
ansv7779 added 1 commit 2025-03-24 23:08:39 +01:00 
Currently, it uses an endpoint similar to OpenID Connect UserInfo but with some differences. The endpoint does not require the "openid" scope for example. There is an ongoing effort to replace the OAuth 2.0 authorization server with a more standard compliant one which would break the endpoint (since it would require the "openid" scope). It is currently not possible to request the "openid" scope to future-proof since Spring would act differently if that scope is present and assume full OpenID Connect. That leads to requiring an id token to have been issued which the current authorization server does not do.

To get around this the implementation is changed to use a standard compliant Token Introspection endpoint to get access to the subject of the access token (which is the only part that's necessary right now). Since the endpoint is standard compliant it will work with any future authorization server.

It may be necessary to run "docker compose up --build" to get the latest version of the Toker containers.
ansv7779 commented 2025-03-24 23:09:15 +01:00
Author
Owner

How to test

  1. Log in as different users (do not use the switch user function)
  2. See that you're logged in as the different users
## How to test 1. Log in as different users (do not use the switch user function) 2. See that you're logged in as the different users
gitea-actions commented 2025-03-24 23:13:19 +01:00
First-time contributor

Deployed to https://scipro-token-introspection-login.branch.dsv.su.se

Deployed to https://scipro-token-introspection-login.branch.dsv.su.se
niat8586 approved these changes 2025-03-25 08:45:15 +01:00
niat8586 left a comment
Owner

👍

👍
niat8586 merged commit e95421b8f2 into develop 2025-03-25 08:45:26 +01:00
niat8586 deleted branch token-introspection-login 2025-03-25 08:45:26 +01:00
andan commented 2025-03-26 09:20:27 +01:00
Owner

Question: I tried to log in on scipro-dev and I was presented the attached error message?

image.png

Question: I tried to log in on scipro-dev and I was presented the attached error message? ![image.png](/attachments/1401c75f-34b6-4a5d-a41f-7dd632dbe8ae)
image.png
86 KiB
ansv7779 commented 2025-03-26 09:45:15 +01:00
Author
Owner

Question: I tried to log in on scipro-dev and I was presented the attached error message?

Try again, should work now.

> Question: I tried to log in on scipro-dev and I was presented the attached error message? Try again, should work now.
Sign in to join this conversation.
No Reviewers
niat8586
No Label
No Milestone
No project
No Assignees
4 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DMC/scipro#141
No description provided.
Delete Branch "token-introspection-login"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?