Java Apache oltu Oauth2令牌验证

我需要使用Apache oltu代码验证oauth.NET应用程序生成的令牌：

OAuthClientRequest oAuthRequest = OAuthClientRequest                        
.tokenLocation("https://URL/idp/connect/identitytokenvalidation")
.setClientId("CLIENTID")        
.setGrantType(GrantType.REFRESH_TOKEN)
.setParameter("token", oauthToken)
.setScope("openid info")
.buildQueryMessage();

OAuthClient oAuthClient = new OAuthClient(new URLConnectionClient());

OAuthAccessTokenResponse oAuthResponse = oAuthClient.accessToken(oAuthRequest, OAuth.HttpMethod.GET);   

它似乎工作正常，因为我从服务器得到了一个回复（它确认令牌有效或无效），但这不是预期的回复。我们的identity server正在以以下方式响应：

auth_time=1439911238, exp=1439911599, sub=300a3657-62f4-4d34-8c60-2c8696780abe, null, null, at_hash=jb6EW9ZgDm60aL573No4sw, null, null, nbf=1439911239, null, null, idp=idsrv, null, iat=1439911239, null, amr=password

但是OAuthAccessTokenResponse验证器提出了一个问题，因为它似乎需要一个令牌，比如：

{
  "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJub25jZSI6IjE0Mzk5MTIxNTI4MjMwLjM0NTUyOTg3MjkyNDA4OTQzIiwiaWF0IjoxNDM5OTEyMTUyLCJhdF9oYXNoIjoiWlItaGlwcGh6YUctSlhkVGRnZTZwQSIsInN1YiI6IjMwMGEzNjU3LTYyZjQtNGQzNC04YzYwLTJjODY5Njc4MGFiZSIsImFtciI6InBhc3N3b3JkIiwiYXV0aF90aW1lIjoxNDM5OTExMjM4LCJpZHAiOiJpZHNydiIsImlzcyI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwIiwiYXVkIjoiaGVhbHRoY29ubmVjdGVkcG9ydGFsIiwiZXhwIjoxNDM5OTEyNTEyLCJuYmYiOjE0Mzk5MTIxNTJ9.MwbkGL85MHookJxqPv9fgae9qZ4iMJiENrY-eaIkC1wqTLuCunpeyNfV88mQZtpkbF3dk8S4uEg2UhhnGjQb-16xFUBf2zujdOujTCPV622k1xrhe3Cs9zsyY0EF4R1wTpNs_kkuMnJgaIeAgzrFki9t6G2QKMrGlcnSPr_UVRhL5KAkX3aWDBDrDGMaDPBVVU8jYV-oK5S4NExFAayWm1d0wXraWVNVcCyRQMDvZB1Jh0rqNcNhMg8EPV0LngZYSqicvyMTKv2eryBVX7sT8MUEi56vgLm-2bl6YWAGcZKSShpmBR3vDMzuuLOiBE9TrSQeu01hWJZEpgAhBu5qsA",
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJjbGllbnRfaWQiOiJoZWFsdGhjb25uZWN0ZWRwb3J0YWwiLCJzY29wZSI6WyJvcGVuaWQiLCJlbWFpbCIsImhyYXVzZXIiLCJkaGNpbmZvIiwiaHJhaW5mbyJdLCJzdWIiOiIzMDBhMzY1Ny02MmY0LTRkMzQtOGM2MC0yYzg2OTY3ODBhYmUiLCJhbXIiOiJwYXNzd29yZCIsImF1dGhfdGltZSI6MTQzOTkxMTIzOCwiaWRwIjoiaWRzcnYiLCJpc3MiOiJodHRwczovL3VhdC5tZWRpcmVzb3VyY2UuY29tL2hjL2lkcCIsImF1ZCI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwL3Jlc291cmNlcyIsImV4cCI6MTQzOTkxMjUxMiwibmJmIjoxNDM5OTEyMTUyfQ.DIqn3JaMziDQXSfAkGDyMT5Loa7HaNvhTnxywq5UTWnnqU6Zhu2yFgWvx73-i0W9ikX30askFmMKvPX0cKnVCFj2ri_jp-F4buJe2m1-3z_ZkMlX38zgthsaifbuvGACba2AlHutvxjhhsPnoTxa6R1qMsPGaEduhD6siPOtUFGFrGVqxOYssSHHX0EX2-AUj41dZTADnuInQwlWraaGPAJCLoCI3Ww1BY5wz9-5Eo6pfXtCZFABZL30TVxfvsXZaTrPWgw-WjhEnG0otFtvVAtjN0z4N-0NhISu-dcoX2KhOU26ckp1XC9xiK8sP-6OC0Bf-1Ecrep3Y_uDCOnBRw",
  "token_type": "Bearer",
  "expires_in": "360",
  "scope": "openid info",
  "state": "14399121528230.34552987292408943",
  "session_state": "1hTuAWL5A_Aj-sGFjpFACF4OI-gnyUEgnxcvImTavtw.0fb69b197f167119b7ab2362882938d8"
}

有线索吗？验证令牌的url使用GET，因此，为了能够使用此方法发送调用，我需要接受作为答复OAuthAccessTokenResponse

我错过什么了吗？

---

Andrea

验证OAuth 2.0令牌的方式没有标准化。这方面的工作正在进行中：这意味着您的验证实现与您的identity server不兼容

---

编辑：这项工作在

中标准化了令牌的验证现在已经标准化，也许您应该更新您的答案，因为它是可接受的；）