Auth (Generic) - Allow ForceIntrospection, pass optional Client ID/Secret on Introspect

[danielmustafa]

Prerequisites

• Search the current open issues

What are you trying to do that currently feels hard or impossible?

Today, for JWT validation, it assumes that JWKS validation should be sufficient. However there are some identity providers who require introspection validation on the access_token. Additionally, some identity providers require a client id / client secret are provided as part of the introspection request.

Suggested Solution(s)

1. Create a flag which allows users to toggle whether or not they want to force introspection on token validation. Default to false so we can maintain backward compatibility
2. Create some environment variables for the client ID and client secret so those values can be passed when performing introspection.
3. Adding these should not affect backward compatibility

pr: #3831

Alternatives Considered

No response

Additional Details

No response