From fb60a1eccbe45f1316f21b0cc811d30e8603417a Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 12:38:45 +0000 Subject: [PATCH] docs: document introspection active=false on disabled subjects Clarify SDK integration guidance that provider introspection can return active=false when user/project/client is disabled after token issuance. --- README.md | 1 + docs/INTEGRATION_GUIDE.md | 1 + 2 files changed, 2 insertions(+) diff --git a/README.md b/README.md index f11e28b..468b6b9 100644 --- a/README.md +++ b/README.md @@ -130,6 +130,7 @@ This wrapper now delegates to `BlackWall\Auth\AuthClient`. - Always validate OAuth `state` in callback handlers. - Handle provider callback errors (`error`, `error_description`) explicitly; treat `access_denied` as an expected user/authorisation outcome rather than a transport failure. - Expect `access_denied` even after the consent page is displayed if provider-side project membership or tenant scope changes before consent submission. +- Expect provider token introspection to return `active=false` when user/project/client state is no longer active. - Register only HTTPS redirect URIs in provider client settings (HTTP should be used only for localhost loopback during development). - Use OAuth/portal authentication endpoints for end users; provider admin login endpoints enforce separate admin scope checks. - For provider admin enrollment URL export operations, use `POST` with CSRF protection; do not automate them via unauthenticated `GET` links. diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index 094c805..58b2484 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -136,6 +136,7 @@ try { `UserInfoException` with `invalid_token` can occur when provider-side subject scope is no longer active (for example user/project disabled) between token issuance and userinfo retrieval. `TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time. +Token introspection can return `active=false` when the token subject (user/project) or client has since been disabled. Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion. WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid. Existing authenticated sessions may also be invalidated when account status changes to disabled.