GluuFederation/oxAuth

feat: add configuration property to AS which will allow to bypass basic client authentication restriction to query only own tokens

mmrraju opened this issue · 1 comments

mmrraju commented

Describe the issue

Target ticket-11512

Introspection endpoint can accept:

  1. Bearer access_token - in this case it's possible to query different clients.
  2. Basic client authentication where client id and client secret are passed explicitly.

For the second approach we need token associated client. Currently not possible for different clients.
So we should make it possible for multiple clients.

yuriyz commented

Issue is fixed in 4.5.2 and war is rebuilt
https://jenkins.gluu.org/maven/org/gluu/oxauth-server/4.5.2.Final/oxauth-server-4.5.2.Final.war

Added new configuration property introspectionRestrictBasicAuthnToOwnTokens with default value false.