[java-oidc-common] branch main updated: JCOMOIDC-129 - Add profile option for reverting 'aud' claims in JWT authentication assertions to tokenEndpointURL

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=36102a9f7cf03cc7da72cf5503f42de2db83233e

The following commit(s) were added to refs/heads/main by this push:
     new 36102a9  JCOMOIDC-129 - Add profile option for reverting 'aud' claims in JWT authentication assertions to tokenEndpointURL
36102a9 is described below

commit 36102a9f7cf03cc7da72cf5503f42de2db83233e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jun 16 12:21:30 2025 +0100

    JCOMOIDC-129 - Add profile option for reverting 'aud' claims in JWT
    authentication assertions to tokenEndpointURL
    
     - The default is now true, which is 'revert the aud claim to be
    specific to a given endpoint'.
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-129
---
 .../config/OAuth2ClientAuthenticableClientProfileConfiguration.java | 6 +++---
 .../impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java | 5 ++---
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
index 51bfadc..cc9e33d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
@@ -74,12 +74,12 @@ public interface OAuth2ClientAuthenticableClientProfileConfiguration
     /**
      * Should the audience claim of a JWT be targeted to a specific endpoint of the recipient? The targeted audience 
      * would be specific to the context in which the JWT is used. For example, the token endpoint URL in a JWT client 
-     * assertion. Defaults to false, where the audience value must be the issuer identifier of the recipient.
+     * assertion.
      * 
      * @param profileRequestContext the profile request context
      * 
-     * @return true if the audience claim should use a targeted endpoint of the recipient, false if the default 
-     * audience applies
+     * @return true if the audience claim should use a targeted endpoint of the recipient, false if the the audience 
+     * value must be the issuer identifier of the recipient
      * 
      * @since 3.3.0
      */
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index 1e653ee..09ccb87 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -103,8 +103,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
         dpopProofNonceGeneratorLookupStrategy;
     
     /** 
-     * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that 
-     * is the audience must be the issuer identifier of the recipient.
+     * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to true.
      */
     @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
     
@@ -140,7 +139,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
         dpopSignatureValidationConfigurationLookupStrategy = FunctionSupport.constant(null);
         requireDpopProofPredicate = PredicateSupport.alwaysFalse();
         dpopProofNonceGeneratorLookupStrategy = FunctionSupport.constant(null);
-        useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
+        useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysTrue();
         clientAuthenticationJWTTypeLookupStrategy = FunctionSupport.constant(null);
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.