Token Introspecting Client Config

The following code sets up a filter to take a token passed in to the web application, and fill in the details as an OAuth2Authentication object by introspecting it with the configured issuer's Introspection Endpoint (configured as the introspectionUrl property). The service authenticates its calls using the clientId and clientSecret properties.

In applicationContext.xml:

    <oauth:resource-server id="resourceServerFilter" token-services-ref="introspectingService" />
    <bean id="introspectingService" class="org.mitre.oauth2.introspectingfilter.IntrospectingTokenService">
        <property name="clientId" value="yourClientId"/>
        <property name="clientSecret" value="yourClientSecret"/>
        <property name="introspectionUrl" value="http://localhost:8080/openid-connect-server/introspect"/>
    </bean>

If the token is valid, the service creates an Authorization with the user in the sub field of the response and the role ROLE_API.