interledger
Validate `/introspect` with RS key instead of client key
Bind the RS to the AS in some way, then use that binding to determine if the key submitted in the request belongs to said RS and then validate the signature that was also provided.
https://datatracker.ietf.org/doc/html/draft-ietf-gnap-resource-servers#section-3.2
The AS MAY require an RS to pre-register its keys or could allow calls from arbitrary keys in a trust-on-first-use model.
It sounds like the RS registering resource sets with the AS can serve as method of pre-registration? https://datatracker.ietf.org/doc/html/draft-ietf-gnap-resource-servers#section-3.4
The request includes:
resource_server (string or object): REQUIRED. The identification used to authenticate the resource server making this call, either by value or by reference as described in Section 3.2.
and the response includes:
instance_id (string): OPTIONAL. An instance identifier that the RS can use to refer to itself in future calls to the AS, in lieu of sending its key by value.
This will now only be necessary for auth servers configured to perform httpsig validation on token introspection requests:
- https://github.com/interledger/rafiki/pull/579
Closing as a consequent of the reasoning in https://github.com/interledger/rafiki/issues/576.
Closing for now due to AS-RS being in a trusted zone