oidc introspection not working

Hi Travis,

I would like to use the oidc access token introspection feature for a project. But it is not working when using a discover_url. In the eas log I this error message:

{"message":"issuer does not support introspection","level":"error","service":"external-auth-server"}

In our oidc metadata there is an “introspection_endpoint” provided. This is according correct to https://tools.ietf.org/html/rfc8414 .

I assume it is caused by this line: https://github.com/travisghansen/external-auth-server/blob/master/src/plugin/oauth/index.js#L1254

I guess it should be

      if (!issuer.metadata.introspection_endpoint) {

Instead of:

      if (!issuer.metadata.token_introspection_endpoint) {

[travisghansen]

@Electrofenster strictly speaking jwt can be used outside of oauth/oidc so it not necessarily implied those are being used (and by extension the introspection feature of the specs) when using basic jwt. It could be added however to the project to support that. Let’s open another ticket to get your requests sorted out. It’s good timing because I’ve got some other minor tweaks to make to the project upcoming 😃

[Electrofenster]

@travisghansen why does the jwt plugin don’t use the introspection endpoint to validate that the accessToken is still valid. When I logout all my sessions in keycloak for the previously authenticated user the accessToken is still valid. I think that’s because the jwt plugin don’t uses the introspection endpoint to validate the accessToken?

Also I don’t get the X-Userinfo - Header with the jwt-plugin 😦