access_token intorspection must be protected by PAT

[yuriyz]

No description provided.

[yuriyz]

return scopes in introspection endpoint

[yuriyz]

fixed in master for 3.0 version

[yuriyz]

[01/12/2017 17:45:19] Yuriy Zabrovarnyy: so with valid access_token it's possible to introspect any access_tokens
[01/12/2017 17:45:51] Yuriy Zabrovarnyy: right now we returning : active: true/false, exp, iat, acr_values
[01/12/2017 17:46:13] Yuriy Zabrovarnyy: only these 4 fields
[01/12/2017 17:53:47 | Edited 17:52:25] Yuriy Zabrovarnyy: 1) If I use the OpenID Connect access token at the calendar API, can the calendar API introspect the access token?yes, we can
[01/12/2017 17:57:44] Michael Schwartz: We need to return scopes too...
[01/12/2017 17:58:30] Michael Schwartz: so with valid access_token it's possible to introspect any access_tokens
[01/12/2017 17:58:38] Michael Schwartz: This is not correct.
[01/12/2017 17:58:51] Michael Schwartz: I think introspection should be limited to a PAT token
[01/12/2017 17:59:28] Michael Schwartz: because any client can dynamically register and obtain an access token