Apache oltu Oauth2 令牌验证

Posted 2023-03-10

【中文标题】Apache oltu Oauth2 令牌验证

【英文标题】：Apache oltu Oauth2 token validation

【发布时间】：2015-11-11 16:18:45

【问题描述】：

我需要使用 Apache oltu 代码验证 oauth .NET 应用程序生成的令牌：

OAuthClientRequest oAuthRequest = OAuthClientRequest                        
.tokenLocation("https://URL/idp/connect/identitytokenvalidation")
.setClientId("CLIENTID")        
.setGrantType(GrantType.REFRESH_TOKEN)
.setParameter("token", oauthToken)
.setScope("openid info")
.buildQueryMessage();

OAuthClient oAuthClient = new OAuthClient(new URLConnectionClient());

OAuthAccessTokenResponse oAuthResponse = oAuthClient.accessToken(oAuthRequest, OAuth.HttpMethod.GET);   

它似乎工作正常，因为我收到了来自服务器的回复（它确认令牌有效或无效），但它不是预期的回复。我们的身份服务器以这种方式回复：

auth_time=1439911238, exp=1439911599, sub=300a3657-62f4-4d34-8c60-2c8696780abe, null, null, at_hash=jb6EW9ZgDm60aL573No4sw, null, null, nbf=1439911239, null, null, idp=idsrv, null, iat=1439911239, null, amr=password

但是 OAuthAccessTokenResponse 验证器提出了一个问题，因为它似乎需要一个令牌，比如这个：

  "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJub25jZSI6IjE0Mzk5MTIxNTI4MjMwLjM0NTUyOTg3MjkyNDA4OTQzIiwiaWF0IjoxNDM5OTEyMTUyLCJhdF9oYXNoIjoiWlItaGlwcGh6YUctSlhkVGRnZTZwQSIsInN1YiI6IjMwMGEzNjU3LTYyZjQtNGQzNC04YzYwLTJjODY5Njc4MGFiZSIsImFtciI6InBhc3N3b3JkIiwiYXV0aF90aW1lIjoxNDM5OTExMjM4LCJpZHAiOiJpZHNydiIsImlzcyI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwIiwiYXVkIjoiaGVhbHRoY29ubmVjdGVkcG9ydGFsIiwiZXhwIjoxNDM5OTEyNTEyLCJuYmYiOjE0Mzk5MTIxNTJ9.MwbkGL85MHookJxqPv9fgae9qZ4iMJiENrY-eaIkC1wqTLuCunpeyNfV88mQZtpkbF3dk8S4uEg2UhhnGjQb-16xFUBf2zujdOujTCPV622k1xrhe3Cs9zsyY0EF4R1wTpNs_kkuMnJgaIeAgzrFki9t6G2QKMrGlcnSPr_UVRhL5KAkX3aWDBDrDGMaDPBVVU8jYV-oK5S4NExFAayWm1d0wXraWVNVcCyRQMDvZB1Jh0rqNcNhMg8EPV0LngZYSqicvyMTKv2eryBVX7sT8MUEi56vgLm-2bl6YWAGcZKSShpmBR3vDMzuuLOiBE9TrSQeu01hWJZEpgAhBu5qsA",
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJjbGllbnRfaWQiOiJoZWFsdGhjb25uZWN0ZWRwb3J0YWwiLCJzY29wZSI6WyJvcGVuaWQiLCJlbWFpbCIsImhyYXVzZXIiLCJkaGNpbmZvIiwiaHJhaW5mbyJdLCJzdWIiOiIzMDBhMzY1Ny02MmY0LTRkMzQtOGM2MC0yYzg2OTY3ODBhYmUiLCJhbXIiOiJwYXNzd29yZCIsImF1dGhfdGltZSI6MTQzOTkxMTIzOCwiaWRwIjoiaWRzcnYiLCJpc3MiOiJodHRwczovL3VhdC5tZWRpcmVzb3VyY2UuY29tL2hjL2lkcCIsImF1ZCI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwL3Jlc291cmNlcyIsImV4cCI6MTQzOTkxMjUxMiwibmJmIjoxNDM5OTEyMTUyfQ.DIqn3JaMziDQXSfAkGDyMT5Loa7HaNvhTnxywq5UTWnnqU6Zhu2yFgWvx73-i0W9ikX30askFmMKvPX0cKnVCFj2ri_jp-F4buJe2m1-3z_ZkMlX38zgthsaifbuvGACba2AlHutvxjhhsPnoTxa6R1qMsPGaEduhD6siPOtUFGFrGVqxOYssSHHX0EX2-AUj41dZTADnuInQwlWraaGPAJCLoCI3Ww1BY5wz9-5Eo6pfXtCZFABZL30TVxfvsXZaTrPWgw-WjhEnG0otFtvVAtjN0z4N-0NhISu-dcoX2KhOU26ckp1XC9xiK8sP-6OC0Bf-1Ecrep3Y_uDCOnBRw",
  "token_type": "Bearer",
  "expires_in": "360",
  "scope": "openid info",
  "state": "14399121528230.34552987292408943",
  "session_state": "1hTuAWL5A_Aj-sGFjpFACF4OI-gnyUEgnxcvImTavtw.0fb69b197f167119b7ab2362882938d8"

有什么线索吗？验证令牌的 url 使用的是 GET，因此为了能够使用此方法发送调用，我需要接受作为回复 OAuthAccessTokenResponse。

我错过了什么吗？ 安德烈亚

【参考方案1】：

验证 OAuth 2.0 令牌的方式没有标准化。正在进行这项工作：https://datatracker.ietf.org/doc/html/draft-ietf-oauth-introspection-11 这意味着您的验证实现与您的身份服务器不兼容。

编辑：这项工作在https://www.rfc-editor.org/rfc/rfc7662中标准化

【讨论】：

令牌的验证现在已经标准化，也许你应该更新你的答案，因为它是被接受的;)