How to properly use an introspection endpoint with identity server 4?

Question

I am using Identity Server 4, and I am trying to use the endpoint of introspection, but only from the documents I do not get it.

The docs just give this example

POST /connect/introspect Authorization: Basic xxxyyy token=<token> 

Now, why does this basic authentication exist and what should be xxxyyy? I mean that in my application there is no basic auth. I just installed Identity Server 4 using the ASP.NET kernel as follows in ConfigureServices :

 services.AddIdentityServer() .AddTemporarySigningCredential() .AddInMemoryApiResources(ApiResourceProvider.GetAllResources()) .AddAspNetIdentity<Usuario>(); 

and in Configure

 app.UseIdentity(); app.UseIdentityServer(); 

Now I tried just POST for / connect / introspect with the body only token=<token> , but it returned 404.

I believe that I really did not understand this.

How do we use the introspection endpoint with Identity Server 4 in the ASP.NET core?

Answer 1

Implementing IdSvr4 is fantastic, but the documents leave much to be desired - I spent an entire hour searching the Internet to find a working solution. What you are told to “read the specification” is not always useful if you are new to the concept, which often happens on their forums.

So, what you have to pass POST/connect/introspect is the secret area.

You can configure quick start by changing the config.cs class. You will need to update the data store that you use if you configured it or do not use quick start - but the concept should (hopefully) be clear.

 public static IEnumerable<ApiResource> GetApiResources() { return new List<ApiResource> { new ApiResource("MyResource", "My_Resource_DisplayName") { ApiSecrets = new List<Secret> { new Secret("hello".Sha256()) }, Scopes= { new Scope("MY_CUSTOM_SCOPE") } } }; } 

Now...
1. Make sure your customer has a scope of MY_CUSTOM_SCOPE
2. Make sure you request the scope of MY_CUSTOM_SCOPE when receiving the bearer token.

Now create a Base64 encoded string with the api resource name and secret, for example like this:

Convert.ToBase64String(Encoding.UTF8.GetBytes(string.Format("{0}:{1}", userName, password)));

Where the username is MyResource and the password is in clear text ( hello use your own values!) - the result should be TXlSZXNvdXJjZTpoZWxsbw== line, which looks like this: TXlSZXNvdXJjZTpoZWxsbw==

Now you can send messages to IDSvr4 ...

 POST /connect/introspect Authorization: Basic TXlSZXNvdXJjZTpoZWxsbw== Accept: application/json Content-Type: application/x-www-form-urlencoded token=<YOUR_TOKEN> 

So, if your bearer token has a scope of MY_CUSTOM_SCOPE (or MY_CUSTOM_SCOPE you called it there), now you can use the IdSvr introspection endpoint to get information about it.

Hope this helps!

Answer 2

Introspection is commonly used by the API to validate an incoming token. In addition, the endpoint of introspection requires authentication by specification.

You need to set up an API secret:

https://identityserver4.readthedocs.io/en/release/reference/api_resource.html

And then use the api name / secret name to authenticate against the endpoint of the introspection. Either using basic authentication, or by submitting values ​​on the form.