[JAMES-3755] IMAP OIDC: optional configuration of a token_instrospection endpoint

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.7.0
• Fix Version/s: 3.8.0
• Component/s: IMAPServer, SMTPServer
• Assignee: Unassigned
• Reporter: Benoit Tellier
• Created: 27/Apr/22 03:54
• Updated: 03/Jun/22 08:47
• Resolved: 03/Jun/22 08:47

Description

Today upon receiving a OIDC auth request James verifies the signature against a configured JWKS endpoint to validate the token.

This decentralized design do not account for revocation.

Several solution to this problem exists:

• Calling the OIDC provider introspection endpoint to validate the token
• Or having a set of invalidated token maintained by the application, this needs to be updated by a backchannel from the OIDC provider.

While my favor tend to go to the second one, the first one is rather common to.

To give an exemple, one of my customers is required to implement the first approach: calling the introspection endpoint.

Proposed solution

• Optional configurable endpoint for checking token validity
• If specified this endpoint will be called to validate OIDC tokens

The call can be performed using a reactor-netty HTTP client.

References

• https://datatracker.ietf.org/doc/html/rfc7662 RFC-7662 OAuth 2.0 Token Introspection

Issue Links

• links to: GitHub Pull Request #1006