Add introspection implementation #925

StevePorter92 · 2018-07-20T16:29:31Z

Off the back of the pull request comments laid out here #869. I thought I would take the comments on board, as I am keen to start using the introspection features already started by @fetzi.

according to RFC 7662 the introspection mechanism is implemented

…flow Co-authored-by: Rob Taylor <robbytaylor@users.noreply.github.com>

…feature/add-introspection-implementation-code-review # Conflicts: # src/Grant/AuthCodeGrant.php

Sephster · 2018-07-27T11:50:36Z

Thanks for this @StevePorter92 and apologies for not picking this up yet. I plan on setting some time aside this weekend to pick up some of the pending PRs. Thanks for your patience and thank you for your contribution

StevePorter92 · 2018-09-14T12:57:42Z

Hey @Sephster, don't suppose you have had a chance to cast your eye of this?

Sephster · 2018-09-17T19:10:27Z

Sorry @StevePorter92 I have not yet. I have been working on numerous things for the library over the past week or so. I'm focussing on getting the PKCE changes into version 8 at the moment as there was at one time 3 separate pull requests trying to address some implemenation concerns around that. Once I've finished this (which is now fairly close to be honest), I will look at getting this reviewed. Thanks for your patience

StevePorter92 · 2018-09-17T20:23:39Z

Hey @Sephster, no worries at all! 😄

src/AuthorizationServer.php

src/ResponseTypes/IntrospectionResponse.php

Sephster · 2018-09-21T20:40:59Z

Hi @StevePorter92. Thanks for your patience here. A couple of things spring to mind at the moment which I think are missing from this at the moment:

The token doesn't have to be a JWT. Although this server provides JWT bearer tokens out the box, implementers are free to use other formats. I don't think this is handled at the moment so will need to be addressed.
I don't believe the introspection end point is protected. We should be protecting this with some form of authentication as it should not be available to public clients. Note that some implementations will put this end point behind a firewall internally so we have to take this into consideration as well.
I don't see how the resource server is using this end point. Can you clarify this.

Thanks for your efforts to date. I hope these comments are useful. Cheers!

StevePorter92 · 2018-11-10T13:41:26Z

Hey @Sephster. Sorry for the delay. Little snowed under recently yes. I've got a few updates I'll check-in hopefully this evening to address your comments. Thanks for the support!

The JWT logic has been moved from the introspection response and is now in the child class BearerTokenIntrospectionResponse

StevePorter92 · 2018-11-11T12:56:58Z

Added some changes to address your comments @Sephster.

The Introspector now validates through a IntrospectionValidator interface. I've moved all of the token logic to a BearerTokenValidator class. This should give implementers the freedom to validate introspection requests for other formats.

I'm a little unsure as to the best way to get the resource server to use our new endpoint so could do with being pointed in the right direction. My current line of thought is to create a AuthorizationValidators\IntrospectionValidator class. I think this will just need the URL of the introspection endpoint as well as any information required for authentication?

Also a little unsure on the best way to protect this new endpoint. What are your thoughts on this?

Thanks again.

ThaDaVos · 2019-03-13T11:46:20Z

So, I'm currently sort of in the need of introspection because I want to use Express Gateways OAuth 2.0 Introspection functionality with my Lumen 5.8 + Passport based Microservice - any eta on the implementation of Introspection?

ThaDaVos · 2019-03-13T11:48:11Z

Sorry for the pings but, anything @StevePorter92 or @Sephster ?

Sephster · 2019-03-13T13:40:05Z

It is awaiting review from myself. I will get to it eventually but don't have a firm timeline for this at present sorry.

ThaDaVos · 2019-03-13T14:01:42Z

Ah okay, currently got it half working by using a separate package - only running into one problem which is that the Authorization header seems to be required to have to validation in the BearerTokenValidator succeed, even though it is in the request body...
Apparently it seems Express Gateway doesn't put it into the Header so I'm a bit stuck and I don't know if this is a Bug in the BearerTokenValidator or not because Express Gateway talks about using a combination of Client_Id:Client_secret as Token Validation Value or something

ThaDaVos · 2019-03-13T15:26:34Z

So when can we expect this to be implemented @Sephster - cause currently it's a big stopper when you want to use the Microservices Architecture with Laravel or Lumen

Or do you have an alternative/workaround?
I tried overriding the ResourceServer so I can return a custom validator (actually just a modified version of the BearerTokenValidator so it looks in the body instead of the header - where it should actually check when using introspection - but... a few needed class members are private...
authorizationValidator and accessTokenRepository

ThaDaVos · 2019-03-14T08:12:28Z

So when can we expect this to be implemented @Sephster - cause currently it's a big stopper when you want to use the Microservices Architecture with Laravel or Lumen

Or do you have an alternative/workaround?
I tried overriding the ResourceServer so I can return a custom validator (actually just a modified version of the BearerTokenValidator so it looks in the body instead of the header - where it should actually check when using introspection - but... a few needed class members are private...
authorizationValidator and accessTokenRepository

StevePorter92 · 2019-03-14T08:49:36Z

As @Sephster said, there isn't currently a timeline for this feature @dvdbot.

Introspection can be achieved with laravel through passport and https://github.com/designmynight/laravel-oauth-introspect-middleware.

Currently what's outstanding is finding a sensible way for the resource server to use introspection. We also need to consider authentication.

@Sephster, when you come to review this, let me know if there's anything I can pick up.

Sephster · 2019-03-14T08:58:17Z

Will do, thanks @StevePorter92. I should have some free time this evening. Unfortunately @dvdbot, this isn't just a case of reviewing the code. I also need to familiarise myself with the RFC to ensure it is conforming to spec which is why PRs such as this take longer than a normal bug fix. I won't be drawn on timescales as I find they are nearly always optimistic. Hope you understand and sorry I can't give a more definitive answer than that

ThaDaVos · 2019-03-14T11:08:46Z

@StevePorter92 and @Sephster - I've got it working for the moment as follows:
I copied the controller from the Laravel Introspection package, then I copied the token validation part from the BearerTokenValidator into the controller, added a public key variable which gets instantiated as follows

$this->publicKey = new CryptKey('file://'.Passport::keyPath('oauth-'. 'public' .'.key'), null, null);

Above I stole from somewhere inside the Passport package 😂

Now I can at least introspect

ralfbecker · 2019-04-07T10:01:56Z

src/AuthorizationServer.php

+    {
+        if ($this->introspectionValidator instanceof IntrospectionValidatorInterface === false) {
+            $this->introspectionValidator = new BearerTokenValidator($this->accessTokenRepository);
+        }


The BearerTokenValidator has no validation-key set, unless you also call here

$this->introspectionValidator->setPrivateKey($this->privateKey);

But that also requires that the public-key is also added to the private-key file, as Lcobucci\JWT\Signer\Rsa::doVerify($expected, $payload, Key $key) calls open_ssl_publickey($key->getContent())!

With that change I was able to verify/introspect access_keys generated by my server.

I'm currently implementing an OpenID Connect / OAuth2 server for EGroupware

canfone · 2019-08-07T07:57:09Z

I'm just wondering why you put the introspection logic in the authorization server? Shouldn't it be in the resource server? Then create a new validator IntrospectionValidator maybe then apply same logic as the BearerTokenValidator but except it doesn't require to be have Authorization header?

arondeparon · 2020-01-15T12:20:44Z

Is this feature still being actively considered for development?

Sephster · 2020-01-15T12:24:07Z

Yes. Rough plan is to get Device Code in place and then this. January is super busy for me as I need to do tax returns etc but will be picking up speed on this soon. Cheers

Veitor · 2020-04-14T01:34:29Z

How is the progress?

ThaDaVos · 2020-06-15T14:48:35Z

Sorry to comment, but any ETA?

mikados · 2021-05-25T15:46:28Z

Sorry to comment. How is the progress?

abbluiz · 2021-07-22T20:32:46Z

How can I help to make this happen? I think this feature would be very useful.

bram-pkg · 2022-02-22T15:04:06Z

I need this to create separate auth and resource servers in a project at work. Any updates? How can I help?

Sephster · 2022-02-22T22:05:18Z

I'm working on the 9.0 release right now so have added this to the milestone but I don't expect this to be out for at least a month, maybe more sorry

fetzi and others added 19 commits March 2, 2018 22:53

Add introspection implementation

9446f0e

according to RFC 7662 the introspection mechanism is implemented

Apply styleci fixes

1ad5514

Apply styleci fixes

651ee9b

Fix phpstan errors

225553f

Apply styleci fixes

880b4bd

Refactor introspection response to not use exceptions to control the …

487241b

…flow Co-authored-by: Rob Taylor <robbytaylor@users.noreply.github.com>

refactor response to be more inline with other package reponses

eba79d7

Merge branch 'master' of github.com:steveporter92/oauth2-server into …

fece711

…feature/add-introspection-implementation-code-review # Conflicts: # src/Grant/AuthCodeGrant.php

update code style

caf15b9

update code style

d143c46

fix type hints for tests

f00b07e

fix code style and unit tests and rename introspection params function

595cace

add validate request method

33eef79

add test for extra params

e4b49c6

code style fixes

baa74fb

code style for test

8bf9c36

add more introspection tests

4af0d2a

add introspect example

b00e6fa

remove blank linbe

4805243

fetzi mentioned this pull request Sep 18, 2018

Add introspection implementation #869

Closed

Sephster reviewed Sep 21, 2018

View reviewed changes

src/AuthorizationServer.php Outdated Show resolved Hide resolved

src/AuthorizationServer.php Outdated Show resolved Hide resolved

src/AuthorizationServer.php Outdated Show resolved Hide resolved

src/ResponseTypes/IntrospectionResponse.php Outdated Show resolved Hide resolved

Steve Porter added 4 commits September 25, 2018 21:03

add missing brackets to new class

5eeb624

update phpdoc to reflect the function

b0e6eff

add missing doc

7def7a8

fix return type

99cb04a

Steve Porter added 6 commits November 11, 2018 12:32

create bearer token validator

d088a3f

add bearer token introspection response

1737752

add introspection validator interface

af2cde2

refactor introspection response

2a1a8b9

The JWT logic has been moved from the introspection response and is now in the child class BearerTokenIntrospectionResponse

update introspector to use introspection validator interface

4611bed

fix code style

2745059

update phpdoc

66f9843

ralfbecker reviewed Apr 7, 2019

View reviewed changes

kromacie mentioned this pull request Dec 11, 2021

Add introspection implementation - updated #1255

Open

Sephster added this to the 9.00 milestone Feb 22, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add introspection implementation #925

Add introspection implementation #925

StevePorter92 commented Jul 20, 2018

Sephster commented Jul 27, 2018

StevePorter92 commented Sep 14, 2018

Sephster commented Sep 17, 2018

StevePorter92 commented Sep 17, 2018

Sephster commented Sep 21, 2018

StevePorter92 commented Nov 10, 2018

StevePorter92 commented Nov 11, 2018

ThaDaVos commented Mar 13, 2019

ThaDaVos commented Mar 13, 2019 •

edited

Sephster commented Mar 13, 2019

ThaDaVos commented Mar 13, 2019

ThaDaVos commented Mar 13, 2019

ThaDaVos commented Mar 14, 2019

StevePorter92 commented Mar 14, 2019

Sephster commented Mar 14, 2019

ThaDaVos commented Mar 14, 2019

ralfbecker Apr 7, 2019

canfone commented Aug 7, 2019

arondeparon commented Jan 15, 2020

Sephster commented Jan 15, 2020

Veitor commented Apr 14, 2020

ThaDaVos commented Jun 15, 2020

mikados commented May 25, 2021

abbluiz commented Jul 22, 2021

bram-pkg commented Feb 22, 2022

Sephster commented Feb 22, 2022

Add introspection implementation #925

Are you sure you want to change the base?

Add introspection implementation #925

Conversation

StevePorter92 commented Jul 20, 2018

Sephster commented Jul 27, 2018

StevePorter92 commented Sep 14, 2018

Sephster commented Sep 17, 2018

StevePorter92 commented Sep 17, 2018

Sephster commented Sep 21, 2018

StevePorter92 commented Nov 10, 2018

StevePorter92 commented Nov 11, 2018

ThaDaVos commented Mar 13, 2019

ThaDaVos commented Mar 13, 2019 • edited

Sephster commented Mar 13, 2019

ThaDaVos commented Mar 13, 2019

ThaDaVos commented Mar 13, 2019

ThaDaVos commented Mar 14, 2019

StevePorter92 commented Mar 14, 2019

Sephster commented Mar 14, 2019

ThaDaVos commented Mar 14, 2019

ralfbecker Apr 7, 2019

Choose a reason for hiding this comment

canfone commented Aug 7, 2019

arondeparon commented Jan 15, 2020

Sephster commented Jan 15, 2020

Veitor commented Apr 14, 2020

ThaDaVos commented Jun 15, 2020

mikados commented May 25, 2021

abbluiz commented Jul 22, 2021

bram-pkg commented Feb 22, 2022

Sephster commented Feb 22, 2022

ThaDaVos commented Mar 13, 2019 •

edited