[JIRA] (JOIDC-144) Improve token audience handling with JWT authentication

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *commented* on JOIDC-144 ( https://shibboleth.atlassian.net/browse/JOIDC-144?atlOrigin=eyJpIjoiMDlhNjgzYTlmZjMyNDFhZWEyMjNkNzE4YTU2YTBiMzciLCJwIjoiaiJ9 )

Re: Improve token audience handling with JWT authentication ( https://shibboleth.atlassian.net/browse/JOIDC-144?atlOrigin=eyJpIjoiMDlhNjgzYTlmZjMyNDFhZWEyMjNkNzE4YTU2YTBiMzciLCJwIjoiaiJ9 )

Refactored the existing *AudienceClaimsValidator* in commons so that it can be extended to deal with multiple accepted audiences. A new validator *AuthenticationAudienceClaimsValidator* extends it and provides means to accept issuer value (responder ID) and token endpoint URL in addition to the single accepted audience

OP now uses the new validator for validating audience claim in the JWT authentication by default. A custom bean can be wired via idp.oauth2.jwtAuth.audienceValidator -property. The default configuration accepts the use of issuer claim (via responder ID lookup), the flow endpoint URL and token endpoint URL in the token, introspection and revocation endpoints. The set of endpoints where to accept the token endpoint URL as audience may be configured via idp.oauth2.jwtAuth.audienceValidator.endpointTargets -property.

( https://shibboleth.atlassian.net/browse/JOIDC-144#add-comment?atlOrigin=eyJpIjoiMDlhNjgzYTlmZjMyNDFhZWEyMjNkNzE4YTU2YTBiMzciLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-144#add-comment?atlOrigin=eyJpIjoiMDlhNjgzYTlmZjMyNDFhZWEyMjNkNzE4YTU2YTBiMzciLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100221- sha1:8830b7c )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230414/ef73f412/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-f9841fcd-4ac3-45d2-bf64-cf0faf093b67
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230414/ef73f412/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-9f7d760c-df3f-4a55-ac2d-f0ff49cb7035
Type: image/png
Size: 448 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230414/ef73f412/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-f3d37206-8b38-4417-8495-68def5c967a9
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230414/ef73f412/attachment-0005.png>