[JIRA] (JOIDC-144) Improve token audience handling with JWT authentication

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiOWNkY2U3ZDMyNjdhNDAwYmE5YTFjNzQ3ZmFkZjUxNWYiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/JOIDC-144?atlOrigin=eyJpIjoiOWNkY2U3ZDMyNjdhNDAwYmE5YTFjNzQ3ZmFkZjUxNWYiLCJwIjoiaiJ9 ) JOIDC-144 ( https://shibboleth.atlassian.net/browse/JOIDC-144?atlOrigin=eyJpIjoiOWNkY2U3ZDMyNjdhNDAwYmE5YTFjNzQ3ZmFkZjUxNWYiLCJwIjoiaiJ9 ) Improve token audience handling with JWT authentication ( https://shibboleth.atlassian.net/browse/JOIDC-144?atlOrigin=eyJpIjoiOWNkY2U3ZDMyNjdhNDAwYmE5YTFjNzQ3ZmFkZjUxNWYiLCJwIjoiaiJ9 )

Issue Type: Improvement Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Components: Introspection Endpoint, Revocation Endpoint, Token Endpoint Created: 27/Mar/23 10:48 AM Priority: Trivial Reporter: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd )

Among other claims validators, the current default security configuration specifies an AudienceClaimsValidator. It verifies that the token used in JWT authentication has an audience (aud) claim pointing to the endpoint that is being called. This doesn’t seem to be fully in inline with the spec [1] , see section 3, bullet 3:

> 
> 
> 
> The JWT MUST contain an "aud" (audience) claim containing a value that
> identifies the authorization server as an intended audience. The token
> endpoint URL of the authorization server MAY be used as a value for an
> "aud" element to identify the authorization server as an intended audience
> of the JWT.
> 
> 

It feels that we should accept both OP’s issuer value and the token endpoint URL as audience by default.

[1] https://www.rfc-editor.org/rfc/rfc7523 ( https://www.rfc-editor.org/rfc/rfc7523 )

( https://shibboleth.atlassian.net/browse/JOIDC-144#add-comment?atlOrigin=eyJpIjoiOWNkY2U3ZDMyNjdhNDAwYmE5YTFjNzQ3ZmFkZjUxNWYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-144#add-comment?atlOrigin=eyJpIjoiOWNkY2U3ZDMyNjdhNDAwYmE5YTFjNzQ3ZmFkZjUxNWYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100219- sha1:0152477 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230327/4a9b7341/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-824b860b-7679-4321-a211-e7afd0820ffb
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230327/4a9b7341/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-8eef4a62-46a1-4774-a6b7-b52dd7edb4d4
Type: image/png
Size: 448 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230327/4a9b7341/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-82c538c3-06fe-4068-9eaa-5869f18a2285
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230327/4a9b7341/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-706fe217-c66c-4bb1-8b89-fe32e1c994bb
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230327/4a9b7341/attachment-0007.png>