Authenticator oauth2_introspection only works if token_type returned is an "access_token"

[daviddelucca]

Describe the bug

When the introspect URL returns a token_type that is not an access_token, Oathkeeper throws an exception:

Introspected token is not an access token but "..."

This error is related to this validation.

Reproducing the bug

Steps to reproduce the behavior:

Server logs

time="2020-10-07T20:41:47Z" level=error msg="An error occurred while handling a request" code=403 debug= details="map[]" error="Access credentials are not sufficient to access this resource" reason="Introspected token is not an access token but \"Bearer\"" request-id=53e06937-f10a-4164-9f6e-d1a2ef2224fd status=403 writer=JSON

Expected behavior

It should accept other token_types instead of works only with access_token.

Environment

• Version: v0.38.2-beta.1
• Environment: Ory Helm Chart

Additional context

If the solution is simple like remove that validation or validate the token_type accross a few values, I could open a PR for it. I have read RFC and I didn't find what are the expected values or if there are any.

[aeneasr]

Yes we should change that - the token_type is Bearer. We'll be introducing a new token_use in the introspection response which would then be access token for example. I think we should fix this here!

[aeneasr]

Would you be up to contributing that change?