Custom introspection

We’re using IS4 1.5.0. In an effort to support multi-tenancy, we’ve customized the introspection endpoint (by implementing IIntrospectionRequestValidator) to allow additional scopes to be specified in the request. This allows claims return by the introspection endpoint to be in a different (tenant)context than the original authN request. It essentially allows API resources to augment requests with different or additional tenant IDs.

To make this work we need a method to allow the introspection middleware to inspect an incoming API request, and based that inspection, specify additional parameters on the introspection request. Maybe something similiar to way token retrieval works:

string token = Options.TokenRetriever(Context.Request);

e.g.

IDictionary<string, string> introspectionParameters = Options.AdditionalParameterRetriever(Context.Request);

which gets added to the introspection request:

public class IntrospectionRequest
{
	public string Token { get; set; }
	public IDictionary<string, string> Parameters { get; set; }
	...
}

There’s also the issue of caching. I hope this makes sense. Thoughts on this approach?

Thanks, Andrew

[andrew-laughlin]

ok thanks. I’ve updated this PR to consume the IdentityModel 2.9.1 release --> https://github.com/IdentityModel/IdentityModel.AspNetCore.OAuth2Introspection/pull/14

[github-actions[bot]]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue.