<div dir="ltr">Thanks for the pointers. I'm still trying to get it working but can I ask about the use-case that the Token Introspecting Client Filter is meant for? We're trying to implement sso as follows:<div><ol>
<li>User logs into portal (portal web app authenticates with Authorization Server)</li><li>User credentials determine the list of applications (all web apps) the user has access to</li><li>Clicking on an app automatically single-sign-ons the user (no confirmation)</li>
</ol><div>I thought that we could use Token Introspecting Client Filter in step 3?</div><div><br></div><div>Here's my spring config, but no luck in getting the filter to kick-in. I'm new to all this so thanks for the patience.</div>
</div><div><br></div><div><div> <security:http pattern="/introspect"</div><div> create-session="stateless"</div><div> entry-point-ref="oauthAuthenticationEntryPoint"</div>
<div> use-expressions="true"></div><div> <security:intercept-url pattern="/introspect" access="permitAll" /><br></div><div> <security:custom-filter before="PRE_AUTH_FILTER" ref="resourceServerFilter" /><br>
</div><div> </security:http><br></div></div><div><div> <oauth2:resource-server id="resourceServerFilter" token-services-ref="introspectingService" /></div><div> <bean id="introspectingService" class="org.mitre.oauth2.introspectingfilter.IntrospectingTokenService"></div>
<div> <property name="introspectionConfigurationService" ref="defaultIntrospectionConfigurationService"/></div><div> <property name="introspectionAuthorityGranter" ref="defaultIntrospectionAuthorityGranter"/></div>
<div> </bean></div></div><div><div> <bean class="org.mitre.oauth2.introspectingfilter.service.impl.StaticIntrospectionConfigurationService" id="defaultIntrospectionConfigurationService"></div>
<div> <property name="introspectionUrl" value="<a href="http://localhost:8080/openid-connect-server-webapp/introspect">http://localhost:8080/openid-connect-server-webapp/introspect</a>" /></div>
<div> <property name="clientConfiguration"></div><div> <bean class="org.mitre.oauth2.model.RegisteredClient"></div><div> <property name="clientId" value="client"/></div>
<div> <property name="clientSecret" value="secret"/></div><div> </bean></div><div> </property></div><div> </bean></div><div> <bean class="org.mitre.oauth2.introspectingfilter.service.impl.SimpleIntrospectionAuthorityGranter" id="defaultIntrospectionAuthorityGranter"/><br>
</div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, May 27, 2014 at 6:36 PM, Justin Richer <span dir="ltr"><<a href="mailto:jricher@mit.edu" target="_blank">jricher@mit.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">No, there isn’t one at this time, but that’s not a bad idea to have something like that in the future.<br>
<br>
In the absence of that, you just need to set up an OAuth 2 resource server from Spring Security OAuth. You can find examples within that project — the bean creates a filter that you then add to your “http” block. Then wire in the “token services” of that filter bean with a copy of the “IntrospectingTokenServices” class, configured to talk to your authorization server. This will effectively act as a stand-in for the usual database-backed token services. From that point, it’s pretty much just using Spring Security and Spring Security OAuth like normal.<br>
<br>
The documentation on the wiki page really should have the most comprehensive information:<br>
<br>
<a href="https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/wiki/Token-Introspecting-Client-Config" target="_blank">https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/wiki/Token-Introspecting-Client-Config</a><br>
<br>
— Justin<br>
<div class=""><br>
On May 27, 2014, at 6:27 PM, Duc Nguyen <<a href="mailto:nguyen.d.duc@gmail.com">nguyen.d.duc@gmail.com</a>> wrote:<br>
<br>
> Hello, is there an example (similar to simple-web-app) of how to use Token Introspection? I've read the source & documentation and been at this the last couple of days so any help would be greatly appreciated. Thanks, -Duc<br>
</div>> _______________________________________________<br>
> mitreid-connect mailing list<br>
> <a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a><br>
> <a href="http://mailman.mit.edu/mailman/listinfo/mitreid-connect" target="_blank">http://mailman.mit.edu/mailman/listinfo/mitreid-connect</a><br>
<br>
</blockquote></div><br></div>