With multiple OIDC client configuration, will SiteMinder allow an introspect call to client2 using to validate an access token generated by client1?
Result from testing showing SiteMinder does not support this since the introspect call is throwing 401.
Is there a workaround or setting in SiteMinder to allow this ?
scenario |
Credential used to get Access token |
Credential used to call Introspection endpoint |
Result from Introspection End point |
Validate accessToken of client 1 |
Client 1 credential |
Client 1 credential |
Able to validate |
Validate accessToken of client 1 |
Client 1 credential |
Client 2 credential |
Error - > 401 Unauthorised |
Validate accessToken of client 2 |
Client 2 credential |
Client 2 credential |
Able to validate |
Validate accessToken of client 2 |
Client 2 credential |
Client 1 credential |
Error - > 401 Unauthorised |
Release :12.8.x
There is no way around this as of today within SiteMinder .
With that being said, if the purpose of the introspect call is to determine if the token is valid or not, use the userinfo service instead which does NOT required client credentials nor client_ID to be passed.
Below are various scenario on using the userinfo service
sysuser@_host ~ % curl -Ss -X POST \
> https://_host.example.com/affwebservices/CASSO/oidc/userinfo \
> -H 'Authorization: Bearer eyJra [...omitted for brevity...] 4Ig'
for a valid token you get :
{"sub":"<user ID>","phone_number":"(800) 555‑0100","email":"<username>@example.com"}
When it sends the invalid token or corrupted token, it returns as:
{"error":"invalid_token","error_description":"Invalid access_token."}
When the token is expired or revoked, it returns as:
{"error":"invalid_token","error_description":"Invalid access_token."}
Open an enhancement request as well for the introspect call and request to include an option in future releases to not require client credentials on the introspect call which will be studied by our PM team and see if this is something that can be considered for future (1).