OIDC introspection endpoint requires token_type_hint which should be optional per RFC 7662

Hello everyone, I'm trying to setup OIDC with Docker Mail Server and Roundcube, I've been struggling for a while with the introspection url sending an "{"active": false}" response because of a missing 'token_type_hint' attribute not set to 'access_token'

I looked at the swagger and casdoor seems to by default require the 'token_type_hint' parameter to be passed as a x-www-form-urlencoded attribute

I am to rebuild casdoor from the sources, dockerize it and run, so I'm thinking of just creating a proxy service that will add that parameter to the incoming request and act as a proxy between dovecot, roundcube and my casdoor instance, would that be a good alternative ?

It would be great if by default the introspect url worked as if receiving an access_token and instead make the 'token_type_hint' attribute not necessary, only when needing to change the token type to refresh token

I've lost about 3 days of debugging dovecot, casdoor and roundcube to understand where the issue was from

I've traced it back to this commit: https://github.com/casdoor/casdoor/commit/a19060c7cb1b8761f834bdcbd6670b68f4e1139b

Why was token_type_hint even added ?

in the oauth RFC it says this attribute should be optional, whic aligns with all configs I've seen so far :

https://datatracker.ietf.org/doc/html/rfc7662

I don't have any knowledge of Go or how the current code works, but from what the RFC indicated, the function named GetTokenByTokenValue in objet/token.go should be this:

func GetTokenByTokenValue(tokenValue, tokenTypeHint *string) (*Token, error) {
    switch  {
    // if no token_type_hint provided, check both access and refresh tokens
    case tokenTypeHint == nil:
    case *tokenTypeHint == "":
        token, err := GetTokenByAccessToken(tokenValue)
        if token != nil {
            return token, nil
        }
        token, err2 := GetTokenByRefreshToken(tokenValue)
        if token != nil {
            return token, nil
        }
        if err2 != nil {
            return nil, err2
        }
    // if either access_token or refresh_token is provided, only search that kind of token
    case *tokenTypeHint == "access_token":
        token, err := GetTokenByAccessToken(tokenValue)
        if err != nil {
            return nil, err
        }
        if token != nil {
            return token, nil
        }
    case *tokenTypeHint == "refresh_token":
        token, err := GetTokenByRefreshToken(tokenValue)
        if err != nil {
            return nil, err
        }
        if token != nil {
            return token, nil
        }
    }
    
    return nil, nil
}

too long to grab the idea..

What do you want? to add the token_type_hint? Is that following the standard? Does casdoor not follow standard right now?

Plz give short sentences, remove emotional words plz..

remember casdoor only follows the standard, it doesn't follow personal preferences, like I want xxx, I want yyy

Sorry, I'll try to make it short, the token_type_hint should be optional as said in the RFC, it's not a want from my end, it's just other tools I use that expect it to be optional don't get the right response as it is a required argument right now in casdoor

@hsluoyz mainly what this section of the RFC on OIDC

And as I said here, I don't have enough knowledge on the casdoor codebase, I just tried to look at where the token_type_hint is used, and it came up here, and I also have never used Go before, but I think something along the lines of this should do what's written in the RFC

so you expect token_type_hint to be optional but it's required param in casdoor, right

Can you create a github issue with full details? (what to expect and what you got, reproduce steps)

so we can track down

Exactly that

I'll do it as soon as I'm home, as it is a side project of mine and I'm currently at work. My workplace is very restrictif on what can be accessed or not.

@hsluoyz I've created the following issue :
https://github.com/casdoor/casdoor/issues/3396

@hsluoyz @dacongda thanks for the quick fix, I really appreciate it, I love casdoor and it's team !