OAuth2 Token Introspection it's not working

• Type: Regression Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.4.1 CE GA2, Master
• Component/s: Application Security > OAuth2
• Labels:
  • backend_test
  • pt-upgrade-review
• Fix Priority: 4
• Last Working Version:
  7.3.6 CE GA7
• Sprint: AppSec Iteration 62
• Git Pull Request: https://github.com/liferay-appsec/liferay-portal/pull/352

Steps to reproduce:

1. Create new OAuth2 application
2. Edit the OAuth2 app and check Token Introspection checkbox
3. Obtain access token using http://martamedio.com/oauth2-tester/
4. Try to Inspect the token using the previous tool or execute from cmd line (set correct client_id, client_secret and token values):

   curl 'http://localhost:8080/o/oauth2/introspect' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     --data 'client_id=XX' \
     --data 'client_secret=XX' \
     --data 'token=7b47179c5dc6dd43bb4d46b5ea47bae0cbf4b04f999b50a255bad7d988725' \
     --compressed
   

Expected Result: Server returns information about the token
Actual Result: Server returns error message