MarcinR.97051 (Customer) asked a question.
Hi All,
I'm porting over some OIDC authentication code from Auth0 to Okta, and I'm seeing some behaviors that I can't quite figure out.
I've created a very basic OIDC application in Okta, and I am using the authorization code flow.
The /authorize endpoint works great. I redirect a user there, and it redirects them back to me with an autorization code.
Next, I exchange the authorization code for tokens via the /token endpoint, which works fine, my API server receives an access_token and an id_token.
However, this is where I get stuck.
You can not trust tokens without verifying them, so my API server needs the JWKS for my OIDC app. I can't find a way to get these. The documentation for the /keys endpoint is incomplete.
When I try to get the JWKS for the default server, O get permission denied:
`curl https://deepmap.okta.com/oauth2/default/v1/keys
{"errorCode":"E0000006","errorSummary":"You do not have permission to perform the requested action","errorLink":"E0000006","errorId":"oae2UVIFczaQfO9ThgaCwFUwQ","errorCauses":[]}`
There is a JWKS available at my top level base URL, but it doesn't contain the keys which were used to sign my access_token and id_token
When I call the /introspect endpoint to validate the tokens, it says
`{
"error": "access_denied",
"error_description": "The requested feature is not enabled in this environment."
}`
So, how do I accomplish this:
1) I would like to have an Okta app in my company dashboard
2) which does the OpenID connect Authorization Code workflow
3) allowing me to verify the JWT's which okta issues.
Thank you.
Oh, I see, /introspect will work if you use your base domain, so it tells you if the token is valid, then you can use a jwk library in your API to parse it without verifying the signature.
However, given an access_token and id_token, how can I get the group membership of the user? I've enabled access to read groups to that token. Do I just use the management API? What's my API token in this case?
Helli Marcin,
Rightly mentioned, If you would like to validate an access token issued by the Okta authorization server, the best way to go would be with the /introspect endpoint. Here is a cURL example to achieve this.
curl -X POST
https://nio.okta.com/oauth2/v1/introspect
-H ‘Accept: application/json’
-H ‘Authorization: Basic Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=’
-d ‘token=ACCESS_TOKEN_HERE&token_type_hint=access_token’
Secondly, I assume that you are using OIDC flow & not the OAuth flow for your web application. In case of the OIDC flow , it can only be used in userinfo request (POST/GET https://subdomain.okta.com/oauth2/v1/userinfo) to get all user claims/groups (depending on scopes passed) for authentication purposes. The OIDC access token (from Okta org as auth server) is considered an opaque token and Okta does not give out keys for this token (You cannot find keys of access token under https://subdomain.okta.com/oauth2/v1/keys).
More Information:
https://support.okta.com/help/s/article/Difference-Between-Okta-as-An-Authorization-Server-vs-Custom-Authorization-Server?language=en_US&_ga=2.124195022.599435358.1602392222-914471284.1577149045