Ytukyg

I am working on WSO2IS 5.6.0 to generate and validate access token for the multi-tenant(each tenants having one or more users) web application by using Service Provider configuration.

Generate Token Request:
Url:https://localhost:9443/oauth2/token
Method: POST
Header:Content-Type:application/x-www-form-urlencoded
Authorization:client_credentials
Body:
grant_type:password
username:
password:

Validate Token Request:
Authorizatin Basic :
Header:Content-Type:application/x-www-form-urlencoded
Body:token:

everything working properly but while validating generated token from one user credential, coming active for another user also.
what I should do to generate/validate the user based token.

Please give me advice.

Hope your problem is the credentials sent as the Authorization header of the token validation request and the token sent for the validation does not belong to the same user.

According to OAuth 2.0 Token Introspection

To prevent token scanning attacks, the endpoint MUST also require some form of authorization to access this endpoint, such as client authentication as described in OAuth 2.0 [RFC6749] or a separate OAuth 2.0 access token such as the bearer token described in OAuth 2.0 Bearer Token Usage [RFC6750]. The methods of managing and validating these authentication credentials are out of scope of this specification.

So the introspection endpoint needs to be secured with some sort of authentication mechanism. WSO2 Identity Server supports Basic authentication with username/password and Bearer authentication. But we can't expect to get the same user's credentials as the Authorization header because, at the point of validating the token, there is no way to get the token owner's credentials or an active token belonging to the user.

So Identity Server expects credentials of a user that has /permission/admin/manage/identity/applicationmgt/view permission for the authorization of the endpoint.

Refer to WSO2 Documentation for more details.