[java-oidc-common] 01/02: Allow for missing aud claim.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch dev/JOIDC-7
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=d7e96cb0d89a40a8bed3c249cb93f01f89c49335

commit d7e96cb0d89a40a8bed3c249cb93f01f89c49335
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Apr 25 13:11:36 2022 -0400

    Allow for missing aud claim.
---
 .../jwt/claims/impl/AudienceClaimsValidator.java   | 24 +++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
index 5ff8f5d..0a3e18d 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
@@ -35,8 +35,8 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
 /**
- * Verifies the Audience (aud) claim contains the client_id of this client (as registered at the issuer). See
- * section 3.1.3.7 of OpenID Connect core 1.0. The audience is determined at runtime using an appropriate strategy.
+ * Verifies the Audience (aud) claim contains the appropriate value.
+ * The audience is determined at runtime using an appropriate strategy.
  */
 @ThreadSafeAfterInit
 public class AudienceClaimsValidator extends AbstractClaimsValidator{
@@ -44,6 +44,8 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
     /** Strategy to find the audience value from the context.*/
     @NonnullAfterInit private BiFunction<ProfileRequestContext,JWTClaimsSet, String> audienceLookupStrategy;
     
+    /** Allow a missing aud claim. */
+    private boolean allowMissing;
     
     /** {@inheritDoc} */
     @Override
@@ -66,6 +68,19 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
         
         audienceLookupStrategy = Constraint.isNotNull(strategy, "Audience lookup strategy can not be null");
     }
+    
+    /**
+     * Set whether a missing 'aud' claim is valid or not.
+     * 
+     * <p>Defaults to false.</p>
+     * 
+     * @param flag flag to set
+     * 
+     * @since 2.1.0
+     */
+    public void setAllowMissing(final boolean flag) {
+        allowMissing = flag;
+    }
 
     @Override
     protected void doValidate(@Nonnull final JWTClaimsSet claims, @Nonnull final ProfileRequestContext context) 
@@ -73,7 +88,7 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
         
         final String acceptedAudience = audienceLookupStrategy.apply(context,claims);
         if (acceptedAudience == null) {
-            throw new JWTValidationException("Audience value not present in the context");
+            throw new JWTValidationException("Audience value not returned by lookup function");
         }
         
         final List<String> audList = claims.getAudience();
@@ -88,10 +103,9 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
             if (!audMatch) {
                 throw new JWTValidationException("JWT audience rejected: " + audList);
             }
-        } else {
+        } else if (!allowMissing) {
             throw new JWTValidationException("JWT missing required audience");
         }
-        
     }
 
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.