OAuth Introspection

Authentication details are passed to a server for verification using an OAuth introspection endpoint.

When OAuth Introspection Authentication is enabled, the WebSEAL configuration parameter sessionlifetime timeout, which is controlled by the timeout entry in the [session] stanza of the WebSEAL configuration file, is ignored. The session lifetime is set to the OAuth token expiry time.

• Enable and disabling OAuth authentication
  The oauth-introspection-auth stanza entry, located in the [oauth-introspection] stanza of the WebSEAL configuration file, enables and disables the OAuth authentication method. By default, OAuth authentication is disabled.
• Configure the OAuth Introspection capability
  The OAuth introspection capability is configured using the [oauth-introspection] stanza.

Parent topic: OAuth Authentication