title: Django OpenID Connect and OAuth2.0 - Splitting Authorization Server and Resource Server
body: <p>I have multiple Resource Servers and one Auth Server all written in Django. I have implemented OIDC Provider in the Auth Server using <a href="https://django-oidc-provider.readthedocs.io/en/latest/" rel="nofollow noreferrer">Django OIDC Provider Library</a>. So it provides OAuth 2.0 support as well.</p>
  <p>Having <a href="https://www.rfc-editor.org/rfc/rfc7662" rel="nofollow noreferrer">OAuth 2.0 Token Introspection (RFC 7662)</a> implemented, it allows authorized protected resources to query the authorization server to determine the set of metadata(and verification) for a given access token that was presented to them by an OAuth 2.0 client.</p>
  <p>I'm getting trouble in setting up the Resource Server, as there's no <code>RESOURCE_SERVER_INTROSPECTION_URL</code> provided like other standard OAuth 2.0 providers for internally verifying the access token with Auth Server(using an internal post request to Auth Server).</p>
  <p>For example in the <a href="https://django-oauth-toolkit.readthedocs.io/" rel="nofollow noreferrer">Django OAuth Toolkit</a> library, it has clearly been specified in their <a href="https://django-oauth-toolkit.readthedocs.io/en/latest/resource_server.html#setup-the-resource-server" rel="nofollow noreferrer">documentation</a>.</p>
  <p>But In Django OIDC Provider, they have provided a hook for that <a href="https://django-oidc-provider.readthedocs.io/en/latest/sections/settings.html#oidc-introspection-processing-hook" rel="nofollow noreferrer"><code>OIDC_INTROSPECTION_PROCESSING_HOOK</code></a>, which I could not understand how to use. Also, there's no detail about it on <a href="https://django-oidc-provider.readthedocs.io/en/latest/sections/tokenintrospection.html" rel="nofollow noreferrer">their official page</a>.</p>
  <p>I need help in setting up my separate resource servers which can rely on my Auth Server for any token creation and verification.</p>
  <p>I want to set up an introspect endpoint something like this in my resource server <code>settings.py</code> file:</p>
  <pre><code>OAUTH_PROVIDER = {
      ...
      'RESOURCE_SERVER_INTROSPECTION_URL': 'https://example.org/o/introspect/',
      'RESOURCE_SERVER_AUTH_TOKEN': '&lt;Interospection Token&gt;', 
      ...
  }
  </code></pre>
  <p>or small customization in their provided default hook will also be helpful. And how to configure it to communicate with my Auth Server.</p>
  <pre><code>def default_introspection_processing_hook(introspection_response, client, id_token):
  
      # Verification Logic Here 
      return introspection_response
  </code></pre>
  <p>Any help will be much appreciated.</p>