Siteminder Introspection Token Endpoint throwing error with different client credenials

Products

• SITEMINDER

Issue/Introduction

 

With multiple OIDC client configuration, will Siteminder allow an introspect call to client2 using to validate an access token generated by client1 ?
Result from testing showing Siteminder does not support this since the introspect call is throwing 401 , is there a workaround or setting in Siteminder to allow this ? 

 

scenario	Credential used to get Access token	Credential used to call  Introspection endpoint	Result from Introspection End point
Validate accessToken of client 1	Client 1 credential	Client 1 credential	Able to validate
Validate accessToken of client 1	Client 1 credential	Client 2 credential	Error - > 401 Unauthorised
Validate accessToken of client 2	Client 2 credential	Client 2 credential	Able to validate
Validate accessToken of client 2	Client 2 credential	Client 1 credential	Error - > 401 Unauthorised

Environment

Release :12.8.x

Resolution

 

• The introspect call behavior you are seeing is Expected and by design since this call requires you to pass the correct client credentials (clientID/Secret) associated with the generated Token (even though you can make the call to introspect service without passing the actual client name , but the client credentials are required) 

There is no way around this as of today within Siteminder .

With that being said, if the purpose of your introspect call is to determine if the token is valid or not , you can always use the userinfo service instead which does NOT required client credentials nor client_ID to be passed .

below are various scenario on using the userinfo service 

sysuser@_host ~ % curl -Ss -X POST \
> https://_host.example.com/affwebservices/CASSO/oidc/userinfo \
> -H 'Authorization: Bearer eyJra [...omitted for brevity...] 4Ig'

 

for a valid token you get :

 

{"sub":"<user ID>","phone_number":"(800) 555‑0100","email":"<username>@example.com"}

 

When it sends the invalid token or corrupted token, it returns as:

 

{"error":"invalid_token","error_description":"Invalid access_token."}

 

When the token is expired or revoked, it returns as:

 

{"error":"invalid_token","error_description":"Invalid access_token."}

 

you can always open an enhancement request as well for the introspect call and request to include an option in future releases to not require client credentials on the introspect call which will be studied by our PM team and see if this is something that can be considered for future --> https://knowledge.broadcom.com/external/article/39337/creating-an-ideaenhancement-request-for.html