[java-idp-oidc] branch main updated: Revise audience handling.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=162ab473b2211d2f42c8b868851274a3d299e1d9

The following commit(s) were added to refs/heads/main by this push:
     new 162ab473 Revise audience handling.
162ab473 is described below

commit 162ab473b2211d2f42c8b868851274a3d299e1d9
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 6 19:44:35 2022 -0500

    Revise audience handling.
---
 .../impl/FormOutboundIntrospectionResponseMessage.java    | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutboundIntrospectionResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutboundIntrospectionResponseMessage.java
index 61577c16..f62e9251 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutboundIntrospectionResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutboundIntrospectionResponseMessage.java
@@ -19,6 +19,8 @@ package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
 
 import java.text.ParseException;
 import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -109,8 +111,8 @@ public class FormOutboundIntrospectionResponseMessage extends AbstractOIDCReques
         log.debug("{} {} token unsealed: {}", getLogPrefix(),
                 tokenClaimsSet instanceof AccessTokenClaimsSet ? "Access" : "Refresh", tokenClaimsSet.serialize());
         
-        if (tokenClaimsSet.isExpired()) {
-            log.debug("{} Token ID {} is expired", getLogPrefix(), tokenClaimsSet.getID());
+        if (!tokenClaimsSet.isTimeValid()) {
+            log.debug("{} Token ID {} is expired or future dated", getLogPrefix(), tokenClaimsSet.getID());
             profileRequestContext.getOutboundMessageContext().setMessage(
                     new TokenIntrospectionSuccessResponse.Builder(false).build());
             return;
@@ -120,8 +122,11 @@ public class FormOutboundIntrospectionResponseMessage extends AbstractOIDCReques
                     new TokenIntrospectionSuccessResponse.Builder(false).build());
             return;
         }
-        
-        // Audience information is not currently carried in tokens but can be inferred as self-targeted for now.
+
+        List<String> audiences = tokenClaimsSet.getAudience();
+        if (audiences == null || audiences.isEmpty()) {
+            audiences = Collections.singletonList(tokenClaimsSet.getClaimsSet().getIssuer());
+        }
         
         profileRequestContext.getOutboundMessageContext().setMessage(
                 new TokenIntrospectionSuccessResponse.Builder(true)
@@ -133,7 +138,7 @@ public class FormOutboundIntrospectionResponseMessage extends AbstractOIDCReques
                         .issueTime(tokenClaimsSet.getClaimsSet().getIssueTime())
                         .subject(new Subject(tokenClaimsSet.getClaimsSet().getSubject()))
                         .issuer(new Issuer(tokenClaimsSet.getClaimsSet().getIssuer()))
-                        .audience(Collections.singletonList(new Audience(tokenClaimsSet.getClaimsSet().getIssuer())))
+                        .audience(audiences.stream().map(Audience::new).collect(Collectors.toUnmodifiableList()))
                         .build());
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.