From 6c3f73db7f9b90fe78acea9a0147a5c40906cab6 Mon Sep 17 00:00:00 2001
From: Guilherme de Freitas <guilherme.de-freitas@diamond.ac.uk>
Date: Tue, 14 Jul 2026 10:47:08 +0100
Subject: [PATCH 1/2] Update "missing Fed ID" message

---
 client/src/js/app/views/login.vue | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/src/js/app/views/login.vue b/client/src/js/app/views/login.vue
index 6abdfbd12..99bef16ba 100644
--- a/client/src/js/app/views/login.vue
+++ b/client/src/js/app/views/login.vue
@@ -5,9 +5,9 @@
     <h1>Login</h1>
     <p v-if="sso && !authError" class="tw-text-center tw-text-lg">Redirecting to single sign on...</p>
     <p v-if="authError === 'not-recognised'" class="tw-text-center tw-text-lg">
-      <b>User not recognised</b>. If you have logged in with your email address,
-      <a :href="logoutUrl" target="_blank">log out of the SSO provider</a> and <a href="/login">log in</a> again with
-      your FedID.
+      <b>User not recognised</b>. You can only access this system once you have been issued a FedID. 
+      If you need to access this system, but don't have a FedID, please contact the User Office, then 
+      <a :href="logoutUrl" target="_blank">log out of the SSO provider</a> and <a href="/login">log in</a> again.
     </p>
 
     <!-- Wrap the form in an observer component so we can check validation state on submission -->

From 57d82bdefb4e623fca2054bc735826a799a2aaa1 Mon Sep 17 00:00:00 2001
From: Guilherme de Freitas <guilherme.de-freitas@diamond.ac.uk>
Date: Mon, 24 Aug 2026 14:05:06 +0100
Subject: [PATCH 2/2] Use introspection endpoint

---
 api/src/Authentication/Type/OIDC.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/api/src/Authentication/Type/OIDC.php b/api/src/Authentication/Type/OIDC.php
index ecda25e9c..ff538d58d 100644
--- a/api/src/Authentication/Type/OIDC.php
+++ b/api/src/Authentication/Type/OIDC.php
@@ -44,9 +44,9 @@ private function getUser($token)
         global $sso_user_key;
         
         $ch = curl_init();
-        curl_setopt($ch, CURLOPT_URL, $this->getProviderConfig()->userinfo_endpoint);
-        curl_setopt($ch, CURLOPT_HEADER, 0);
-        curl_setopt($ch, CURLOPT_HTTPHEADER, array('Authorization: Bearer ' . $token));
+        curl_setopt($ch, CURLOPT_URL, $this->getProviderConfig()->introspection_endpoint);
+        curl_setopt($ch, CURLOPT_POSTFIELDS, array('token' => $token));
+        curl_setopt($ch, CURLOPT_HTTPHEADER, array('Authorization: Basic ' . $this->getProviderConfig()->b64ClientCreds));
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
         $response = curl_exec($ch);
         curl_close($ch);