Support for org authorization servers

[okta]

Support for org authorization servers

[swaincreates]

That makes sense! Yes, with the claims in the id_token I suppose I don't need to make a call to /userinfo. And part of me thought i'd run into this same error with the id_token but I just verified that validating the id_token works fine. Thank you!

[aarongranick-okta]

@swaincreates Thanks for the question. Does this integration require validating the access token? My basic understanding of the issue is that the access token from the Org authorization server is meant for securing access to the Okta API and is not necessarily appropriate for securing access to customer resources. I'm guessing applications which are using the Org server as issuer are primarily interested in the id_token, which has the full list of claims.

[bdemers]

@aarongranick-okta is correct, access tokens from an Org authorization server cannot be validated as a JWT, but must be treated as an opaque access token.

id_tokens CAN be validated as a JWT (but those tokens are not used the same way).

More background info:
Access tokens are opaque per the OAuth 2 spec. It just happens that many IdPs implement them with JWTs (so common in fact that Spring Security supported JWT based access tokens before they supported "opaque" tokens.)

Okta only supports JWT access tokens for "Custom Authorization Servers", which would be typically used if you were creating a API/REST server.

If you can tell us a little more about your use case we can probably point you in the right direction.

[arvindkrishnakumar-okta]

Closing this due to inactivity, feel free to open if followup is needed.