ID token ok but how about access token ?

[pitufo1972]

hi,
simplesaml returns to me the content of the ID token which is correct but does not return the access token; can you clarify how I can view the access token value ?
this the json I see:
{
"Attributes": {
"someprefix.sub": [
"2hjik2jMxFxAgKc06YOn_Q=="
]
},
"Authority": "oauth2",
"AuthnInstant": 1619077956,
"Expire": 1619106756
}

cheers

[pradtke]

The access token value is not put into the state array and is not visible to end users. The server is suppose to keep the token value secret and putting it into the auth state would leak it if a user went to the test authentication sources page.

[pitufo1972]

yes I understand that access token has to remain on server side; my question is more how the server can retrieve that value in order to all APIs with it later on ? can you share maybe the code to call to get the value ?

tx

[pitufo1972]

any hint how I can get that access token to call APIs ?

[pradtke]

The access token is not saved for future use. You could subclass the OAuth2 authsource and override postFinalStep and store the token somewhere and access it later. If the extra API calls are just things you want to call once, at authentication, then you can set authenticatedApiRequests and the configured endpoints will get queried during user login.

[pitufo1972]

hi again,
sorry for long delay...
still on same subject, I would like to do a POST on /introspect url of IDP to verify that the access_token is valid
can you clarify how I could do that ?