feat: OAuth 2.0 Token Introspection (RFC 7662, RFC 9701)#2
Open
Kunde21 wants to merge 16 commits into
Open
Conversation
Add normalizeResources and addResourceParameters helpers for RFC 8707 resource indicator support. normalizeResources trims whitespace, rejects empty values, requires absolute URIs, and rejects fragments.
Add WithResources Option for default resource indicators, SetResources AuthorizationURLOption for per-request overrides, and WithTokenResources context helper for per-request token overrides. Add optionErrors to clientConfig for deferred validation, checked in both New and NewClientCredentials constructors.
Authorization URLs include repeated resource parameters. Resources are preserved in signed request objects (JAR), PAR, and RP-hosted request_uri flows. Callback correlation persists resources through the state store and sends them during authorization-code token exchange.
RefreshToken sends configured default resources. WithTokenResources overrides resources per-request via context.
ClientCredentials.Token sends configured default resources. WithTokenResources overrides resources per-request via context. Invalid context resources return errors before calling the endpoint.
Add Resource Indicators section to package doc, RFC 8707 capability to README, and example test for WithResources with client credentials.
Add RFC 9701 introspection signing/encryption algorithm metadata fields to AuthorizationServer and extend mergeProvider to merge introspection endpoint configuration.
Add IntrospectionRequest, IntrospectionResponse with raw payload preservation, TokenTypeHint constants, ErrIntrospectionFailed sentinel, and Introspector struct stub.
Add NewIntrospector constructor with endpoint-specific auth method resolution. Extract selectAuthMethodFromSupported from resolveAuthMethodFromProvider for reuse. Add introspectionEndpoint helper with mTLS alias support.
Add Introspector.IntrospectToken and RP.IntrospectToken methods with client_secret_basic, client_secret_post, private_key_jwt, client_secret_jwt, TLS, and none auth method support. Includes DPoP retry, auth method fallback, and extracted buildClientSecretJWTAssertion shared helper.
Add tests and implementation for private_key_jwt, client_secret_jwt, none, self_signed_tls_client_auth, auth method fallback (post to basic), DPoP proof attachment, and DPoP nonce retry.
Add JWT introspection response validation with signature verification, typ/iss/aud/iat claims checking, algorithm enforcement from provider metadata, encrypted JWT rejection, and none algorithm rejection. Fix doJSONStatus to preserve custom Accept headers.
Add RP.IntrospectToken tests for credentials, introspection-specific auth methods, error paths. Add introspectionAuthMethod() to resolve introspection endpoint auth independently from token endpoint. Add public API compile test. Update package docs and README.
Use shouldUseDPoPForMethod(method) instead of shouldUseDPoP() so that DPoP is correctly enabled when the introspection endpoint uses a different auth method than the token endpoint. Also removes dead code in introspectionAuthMethod and renames isJWTContentType to looksLikeJWT for clarity.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Introspectorclient for resource-server style token introspection viaNewIntrospector()RP.IntrospectToken()for introspection from existing RP instancesAuthorizationServerwith provider merge supportTest Plan
go test ./...passes cleangofumpt -w .andgo vet ./...clean