Closed
Description
The contract for OAuth2TokenIntrospectionClient
is String
-> Map
, taking an opaque token and returning its associated attributes.
The name of the class implies that only implementations that are clients to an OAuth 2.0 Token Introspection endpoint are acceptable.
However, there are use cases where an application has a token and would like to verify and introspect it in a custom way, say via a Redis store.
As such, it would be better if this class were named something more generic like OpaqueTokenIntrospector
.
Additionally, the DSL should change to correspond. What was:
http
.oauth2ResourceServer()
.opaqueToken()
.introspectionClient(...)
Should now be:
http
.oauth2ResourceServer()
.opaqueToken()
.introspector(...)