How To: Fix OAuth Introspection Endpoint Always Returning False

Version Affected: All

 

Overview

When calling the OAuth Introspection endpoint, it always returns Active: False, even when the token is still valid.

How To: Test OAuth / OpenID Connect Flows

 

Cause

Enable User Consent Storage must be set to True for Introspection to work.

Resolution:

1. Open the SecureAuth Admin Console.
2. Navigate to the Post Auth page of the OAuth/OpenID realm.
3. Set Enable User Consent Storage to True.
4. Select a Consent Storage Attribute, such as Aux ID 10, as shown below.

5. Save the changes.
6. On the Data tab, select an unused Active Directory (AD) attribute matching the one selected in step 4, such as houseidentifier, and check the box to make it writable, as shown below.

7. Save the changes.
8. Go back to the Post Auth page.
9. Scroll down to OpenID Connect/OAuth 2.0 - Clients and click the client.
10. Set Introspection to TRUE, as shown below.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.