We are trying to use Mule Oauth2.0 Provider module as part of authentication project. The issue which we are facing is that 'Validation Token component successfully validating the access_token which is expired'.

As part of settings we kept Total ttl=120 and Token ttl timeout unit= Seconds.

But after 120 seconds when client tries to use the expired access token, he is still able to by-pass the validation, where are our expectation is that Oauth2.0 validation should fail with error type 'OAUTH2-PROVIDER:TOKEN_UNAUTHORIZED'.

Please find below details configuration xml for reference.

Note:

As of now we are going with a workaround using component Revoke token, which we are applying it after specified time in async scope which is doing the job. But as per our understanding this is not an ideal solution.

Reference XML:

<mule

 xmlns:scripting="http://www.mulesoft.org/schema/mule/scripting"

 xmlns:oauth="http://www.mulesoft.org/schema/mule/oauth"

 xmlns:ee="http://www.mulesoft.org/schema/mule/ee/core"

 xmlns:os="http://www.mulesoft.org/schema/mule/os"

 xmlns:oauth2-provider="http://www.mulesoft.org/schema/mule/oauth2-provider"

 xmlns:http="http://www.mulesoft.org/schema/mule/http"

 xmlns="http://www.mulesoft.org/schema/mule/core"

 xmlns:doc="http://www.mulesoft.org/schema/mule/documentation"

 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

 xsi:schemaLocation="http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd

http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd

http://www.mulesoft.org/schema/mule/oauth2-provider http://www.mulesoft.org/schema/mule/oauth2-provider/current/mule-oauth2-provider.xsd

http://www.mulesoft.org/schema/mule/os http://www.mulesoft.org/schema/mule/os/current/mule-os.xsd

http://www.mulesoft.org/schema/mule/ee/core http://www.mulesoft.org/schema/mule/ee/core/current/mule-ee.xsd

http://www.mulesoft.org/schema/mule/oauth http://www.mulesoft.org/schema/mule/oauth/current/mule-oauth.xsd

http://www.mulesoft.org/schema/mule/scripting http://www.mulesoft.org/schema/mule/scripting/current/mule-scripting.xsd">

 <http:listener-config name="HTTP_Listener_config"

  doc:name="HTTP Listener config"

  doc:id="778f937f-a80a-4060-be6c-8f5212c8b73b">

  <http:listener-connection host="0.0.0.0"

   port="8080" />

 </http:listener-config>

 <os:object-store name="client-os"

  doc:name="Object store" doc:id="91296a69-57d5-4766-ac76-ec1ff662acc8" />

 <os:object-store name="token-os"

  doc:name="Object store" doc:id="82a51666-3c83-4b32-9c06-32e97abb6ab6" />

 <oauth2-provider:config

  name="OAuth2_Provider_Config" doc:name="OAuth2 Provider Config"

  doc:id="66ea9233-dfeb-44af-bf79-8a2e01b56cbb"

  listenerConfig="HTTP_Listener_config" clientStore="client-os"

  supportedGrantTypes="CLIENT_CREDENTIALS">

  <oauth2-provider:client-validation-rate-limiter >

   <oauth2-provider:period-rate-limiter duration="60" />

  </oauth2-provider:client-validation-rate-limiter>

  <oauth2-provider:token-config tokenStore="token-os" tokenTtl="120" >

  </oauth2-provider:token-config>

 </oauth2-provider:config>

 <flow name="create-client" doc:id="8373609a-4a30-4662-bf4e-93a316d1619f" >

  <http:listener doc:name="Listener" doc:id="3371c037-6f19-4f07-adb8-fb8435dfa0bb" config-ref="HTTP_Listener_config" path="/create"/>

  <oauth2-provider:create-client doc:name="Create client" doc:id="d1a9fdf4-fe08-4bb9-9e39-264c3489bd39" config-ref="OAuth2_Provider_Config" clientId="#attributes.headers.client_id" type="CONFIDENTIAL" secret="#attributes.headers.client_secret" description='#""' principal='#""' redirectUris='#["abc.com"]' authorizedGrantTypes='#["CLIENT_CREDENTIALS"]' failIfPresent="true"/>

  <ee:transform doc:name="Transform Message" doc:id="fd369b5a-ccf6-47e2-9a54-507c4aa1d4d2" >

   <ee:message >

    <ee:set-payload ><![CDATA[%dw 2.0

output application/json

---

"Client Created"]]></ee:set-payload>

   </ee:message>

  </ee:transform>

 </flow>

 <flow name="validate-token" doc:id="23febab6-588e-46fe-9487-82711b26f291" >

  <http:listener doc:name="Listener" doc:id="89b2d88f-7532-46bc-b9db-576bc6c8dd1b" config-ref="HTTP_Listener_config" path="/validate"/>

  <oauth2-provider:validate-token doc:name="Validate token" doc:id="ef60d50a-c3a9-497f-8f3f-49c6b992e317" config-ref="OAuth2_Provider_Config"/>

  <ee:transform doc:name="Transform Message" doc:id="06f69772-b600-407e-aa97-c5a796356af1">

   <ee:message>

    <ee:set-payload><![CDATA[%dw 2.0

output application/json

---

payload]]></ee:set-payload>

   </ee:message>

  </ee:transform>

 </flow>

</mule>