Access token with introspection vs. ID token with manual inspection

Getting advice
, ,
1

My application (let’s call it “A”) is relying on Keycloak for authentication with OIDC, and everything works fine.

Now, from A (on the back-end side), I need to call another application (called “B”) and I’d like to integrate it with Keycloak (I can make changes to B).

Should I:

a) send the OpenID Connect ID Token to B, and have B validate it?
b) send the OAuth 2.0 Access Token to B, and have B call the Token Introspection endpoint?
c) any of the above would be fine?

I’m looking just for few generic pointers, as I wasn’t able to find advice in the OIDC specification.

Thanks!

2

The ID token is always only issued to the client itself, it will not be forwarded.
The Access token is the one for be forwarded. As it is a JWT, it can be validated offline or by sending it to the introspection endpoint.