[APIM][3.2.0] API resources can be accessed using id_token

[Hashini-Deshappriya]

Description

Hi Team,

• In APIM 3.2.0 it is able to access the API resources using both the ID token and the access token. However, the expected behavior is to allow access using only the access token, not the ID token.
• Both the access token (opaque) and the ID token were allowing access to the exposed API in APIM, returning a 200 response.

Regards,
Hashini

Steps to Reproduce

[1] - Call authorize endpoint.
[2] - Call token endpoint & obtain the access token and the id token.
[3] - Invoke the API resource with id_token

Affected Component

APIM

Version

3.2.0