Hello, I am experiencing an issue with the token introspection endpoint. When using `client_secret_basic` authentication method for `/oxauth/restv1/introspection` endpoint, the response is always `401 Unauthorized`. The client credentials are valid though. If I use them to obtain a client credentials access token, everything works. ## Expected behavior This should work: ``` # 1. Obtain access token curl --insecure -v -u '<client-id>:<client-token>' -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=password&username=user&password=secret&scope=email user_name' https://login.example.com/oxauth/restv1/token 200 OK {"access_token":"1234",...} # 2. Introspect token curl --insecure -v -u '<client-id>:<client-token>' -H 'Content-Type: application/x-www-form-urlencoded' -d 'token=1234&token_type_hint=access_token' https://login.example.com/oxauth/restv1/introspection 200 OK {"active":true,...} ``` ## Actual behavior The request fails: ``` # 1. Obtain access token curl --insecure -v -u '<client-id>:<client-token>' -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=password&username=user&password=secret&scope=email user_name' https://login.example.com/oxauth/restv1/token 200 OK {"access_token":"1234",...} # 2. Introspect token curl --insecure -v -u '<client-id>:<client-token>' -H 'Content-Type: application/x-www-form-urlencoded' -d 'token=1234&token_type_hint=access_token' https://login.example.com/oxauth/restv1/introspection 401 Unauthorized {"error":"access_denied","error_description":"The resource owner or authorization server denied the request."} ``` It does work though, if the client uses bearer authentication for introspection: ``` # 1. Obtain access token curl --insecure -v -u '<client-id>:<client-token>' -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=password&username=user&password=secret&scope=email user_name' https://login.example.com/oxauth/restv1/token 200 OK {"access_token":"1234",...} # 2. Obtain client token curl --insecure -v -u '<client-id>:<client-token>' -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=client_credentials' https://login.example.com/oxauth/restv1/token 200 OK {"access_token":"abcd",...} # 3. Introspect token curl --insecure -v -H 'Authorization: Bearer abcd' -H 'Content-Type: application/x-www-form-urlencoded' -d 'token=1234&token_type_hint=access_token' https://login.example.com/oxauth/restv1/introspection 200 OK {"active":true,...} ``` The issue seems to be in https://github.com/GluuFederation/oxAuth/blob/c6f9caede63f9c12d222eb91dee4c2f48866609b/Server/src/main/java/org/xdi/oxauth/introspection/ws/rs/IntrospectionWebService.java#L174. The code tries to obtain an `AuthorizationGrant` for the authenticated client, but passes the base64 encoded client credentials as an access token to `authorizationGrantList.getAuthorizationGrantByAccessToken()`.