title: how to validate WSO2 oauth2 access token on Resource Server
body: <p>I am looking for fittings ends to our SSO puzzle.</p>
  
  <p>Currently we have an OpenLDAP behind WSO2 Identity Provider. A client (Service Provider) redirects authorization to the IP (OAuth2) and recieves an access_token.</p>
  
  <p>All fine.</p>
  
  <p>Next step is to validate this token on another Service Provider, in this case a reverse proxy (Apache or Nginx) residing on another EC2 instance, which protects a number of unprotected 3rd party applications (3rd party in the sense that we can't touch source code, but do the hosting our selves). Which tools do serve this request?</p>
  
  <p>Am am aware that the OAuth2 spec leaves a hiatus here and that there is draft which adds a <code>/introspect</code> call to validate this token. I also know that pingidentity implements this draft as part of there Apache module (<a href="https://github.com/pingidentity/mod_auth_openidc" rel="nofollow">https://github.com/pingidentity/mod_auth_openidc</a>).</p>
  
  <p>I am just wondering how to implement this on the WSO2-IS side, as I don't find documentation.</p>
  
  <p>*bonus: we also hit several errors while deploying WSO2 (SQL errors) and using it (<a href="https://wso2.org/jira/browse/IDENTITY-3009" rel="nofollow">https://wso2.org/jira/browse/IDENTITY-3009</a>) which made us a bit distrusting about the product.</p>