如何验证OAuth2 + PCKE流的访问令牌

时间:2019-04-24 15:57:55

标签: api session login token onelogin

根据本文档 https://developers.onelogin.com/openid-connect/guides/auth-flow-pkce

PCKE流的令牌端点为(不是Basic或POST)

enter image description here

因此,我如何使用验证令牌API https://developers.onelogin.com/openid-connect/api/validate-session,因为它支持Basic authenticationPOST,但不支持None (PCKE),我找不到与此相关的任何信息

注意::我尝试使用基本身份验证请求,并且没有使用+ client_id,client_secret作为参数,但是无法正常工作。

响应401未经授权

{
    "error": "invalid_client",
    "error_description": "client authentication failed"
}

2 个答案:

答案 0 :(得分:1)

我将OIDC与PKCE结合使用,并且设法通过通过授权代码流检索的令牌调用https://openid-connect.onelogin.com/oidc/token/introspection端点:

$ curl -i -d "token=...&token_type_hint=access_token&client_id=..." https://openid-connect.onelogin.com/oidc/token/introspection

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Content-Length: 304
Content-Type: application/json; charset=utf-8
Date: Thu, 25 Apr 2019 23:37:42 GMT
Pragma: no-cache
X-Powered-By: Express
Set-Cookie: ol_oidc_canary_040819=false; path=/; domain=.onelogin.com

{"active":true,"sub":"...","client_id":"...","exp":1558819177,"iat":1556227177,"sid":"...","iss":"https://openid-connect.onelogin.com/oidc","jti":"...","scope":"openid profile email"}

从验证码流https://developers.onelogin.com/openid-connect/api/authorization-code-grant返回的access_tokenrefresh_token都起作用,并且access_token仅在{"active":false}过期后返回。

确保未设置Authorization标头,而仅在有效负载中设置client_id

答案 1 :(得分:1)

在POST正文中使用client_id和code_verify。这将在该端点上验证请求。