Repository: cxf Updated Branches: refs/heads/master b18cc39a1 -> 3a6981463
Adding support for validating audiences for JWT tokens as well as supporting multiple audiences Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/3a698146 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/3a698146 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/3a698146 Branch: refs/heads/master Commit: 3a69814631980dc348be5859ca85e5acd100d189 Parents: b18cc39 Author: Colm O hEigeartaigh <[email protected]> Authored: Thu Dec 3 12:30:10 2015 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Thu Dec 3 12:55:02 2015 +0000 ---------------------------------------------------------------------- .../jose/jaxrs/JwtAuthenticationFilter.java | 2 +- .../cxf/rs/security/jose/jwt/JwtClaims.java | 20 +++++++++-- .../cxf/rs/security/jose/jwt/JwtUtils.java | 31 ++++++++++++++++- .../oauth2/grants/jwt/AbstractJwtHandler.java | 5 +-- .../oauth2/tokens/jwt/JwtAccessTokenUtils.java | 35 +++++++++----------- .../oidc/rp/AbstractTokenValidator.java | 6 ++-- .../cxf/rs/security/oidc/rp/IdTokenReader.java | 3 ++ .../cxf/rs/security/oidc/rp/UserInfoClient.java | 14 ++++---- .../security/jose/jwt/JWTAlgorithmTest.java | 14 ++++++++ .../security/jose/jwt/JWTAuthnAuthzTest.java | 5 +++ 10 files changed, 98 insertions(+), 37 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java index 2dc6095..97c127d 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java @@ -96,7 +96,7 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements @Override protected void validateToken(JwtToken jwt) { - JwtUtils.validateTokenClaims(jwt.getClaims(), ttl, clockOffset); + JwtUtils.validateTokenClaims(jwt.getClaims(), ttl, clockOffset, true); } public int getClockOffset() { http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtClaims.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtClaims.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtClaims.java index 6fcc85d..fe5b08a 100644 --- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtClaims.java +++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtClaims.java @@ -19,6 +19,8 @@ package org.apache.cxf.rs.security.jose.jwt; +import java.util.Collections; +import java.util.List; import java.util.Map; import org.apache.cxf.jaxrs.json.basic.JsonMapObject; @@ -52,11 +54,23 @@ public class JwtClaims extends JsonMapObject { } public void setAudience(String audience) { - setClaim(JwtConstants.CLAIM_AUDIENCE, audience); + setAudiences(Collections.singletonList(audience)); } - public String getAudience() { - return (String)getClaim(JwtConstants.CLAIM_AUDIENCE); + public void setAudiences(List<String> audiences) { + setClaim(JwtConstants.CLAIM_AUDIENCE, audiences); + } + + @SuppressWarnings("unchecked") + public List<String> getAudiences() { + Object audiences = getClaim(JwtConstants.CLAIM_AUDIENCE); + if (audiences instanceof List<?>) { + return (List<String>)audiences; + } else if (audiences instanceof String) { + return Collections.singletonList((String)audiences); + } + + return Collections.emptyList(); } public void setExpiryTime(Long expiresIn) { http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java index fa6989a..f07a071 100644 --- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java +++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java @@ -20,6 +20,9 @@ package org.apache.cxf.rs.security.jose.jwt; import java.util.Date; +import org.apache.cxf.message.Message; +import org.apache.cxf.phase.PhaseInterceptorChain; + public final class JwtUtils { private JwtUtils() { @@ -110,7 +113,29 @@ public final class JwtUtils { } } - public static void validateTokenClaims(JwtClaims claims, int timeToLive, int clockOffset) { + public static void validateJwtAudienceRestriction(JwtClaims claims, Message message) { + // Get the endpoint URL + String requestURL = null; + if (message.getContextualProperty(org.apache.cxf.message.Message.REQUEST_URL) != null) { + requestURL = (String)message.getContextualProperty(org.apache.cxf.message.Message.REQUEST_URL); + } + + if (requestURL != null) { + boolean match = false; + for (String audience : claims.getAudiences()) { + if (requestURL.equals(audience)) { + match = true; + break; + } + } + if (!match) { + throw new JwtException("Invalid audience restriction"); + } + } + } + + public static void validateTokenClaims(JwtClaims claims, int timeToLive, int clockOffset, + boolean validateAudienceRestriction) { // If we have no issued time then we need to have an expiry boolean expiredRequired = claims.getIssuedAt() == null; validateJwtExpiry(claims, clockOffset, expiredRequired); @@ -120,6 +145,10 @@ public final class JwtUtils { // If we have no expiry then we must have an issued at boolean issuedAtRequired = claims.getExpiryTime() == null; validateJwtIssuedAt(claims, timeToLive, clockOffset, issuedAtRequired); + + if (validateAudienceRestriction) { + validateJwtAudienceRestriction(claims, PhaseInterceptorChain.getCurrentMessage()); + } } } http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java index 0177323..5855165 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java @@ -54,11 +54,10 @@ public abstract class AbstractJwtHandler extends AbstractGrantHandler { } protected void validateClaims(Client client, JwtClaims claims) { - JwtUtils.validateTokenClaims(claims, ttl, clockOffset); + JwtUtils.validateTokenClaims(claims, ttl, clockOffset, true); validateIssuer(claims.getIssuer()); validateSubject(client, claims.getSubject()); - validateAudience(client, claims.getAudience()); // We must have an Expiry if (claims.getClaim(JwtConstants.CLAIM_EXPIRY) == null) { @@ -78,8 +77,6 @@ public abstract class AbstractJwtHandler extends AbstractGrantHandler { throw new OAuthServiceException(OAuthConstants.INVALID_GRANT); } } - protected void validateAudience(Client client, String audience) { - } public void setSupportedIssuers(Set<String> supportedIssuers) { this.supportedIssuers = supportedIssuers; } http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/jwt/JwtAccessTokenUtils.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/jwt/JwtAccessTokenUtils.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/jwt/JwtAccessTokenUtils.java index c413d00..76d371f 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/jwt/JwtAccessTokenUtils.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/jwt/JwtAccessTokenUtils.java @@ -20,6 +20,7 @@ package org.apache.cxf.rs.security.oauth2.tokens.jwt; import java.security.interfaces.RSAPrivateKey; import java.security.interfaces.RSAPublicKey; +import java.util.List; import javax.crypto.SecretKey; @@ -38,7 +39,6 @@ import org.apache.cxf.rs.security.jose.jws.JwsUtils; import org.apache.cxf.rs.security.jose.jws.NoneJwsSignatureProvider; import org.apache.cxf.rs.security.jose.jwt.JwtClaims; import org.apache.cxf.rs.security.jose.jwt.JwtToken; -import org.apache.cxf.rs.security.jose.jwt.JwtUtils; import org.apache.cxf.rs.security.oauth2.common.Client; import org.apache.cxf.rs.security.oauth2.common.ServerAccessToken; import org.apache.cxf.rs.security.oauth2.tokens.bearer.BearerAccessToken; @@ -110,32 +110,29 @@ public final class JwtAccessTokenUtils { throw new SecurityException(); } } - public static void validateJwtClaims(JwtClaims claims, int ttl, int clockOffset, Client c) { - validateJwtSubjectAndAudience(claims, c); - - // If we have no issued time then we need to have an expiry - boolean expiredRequired = claims.getIssuedAt() == null; - JwtUtils.validateJwtExpiry(claims, clockOffset, expiredRequired); - - JwtUtils.validateJwtNotBefore(claims, clockOffset, false); - - // If we have no expiry then we must have an issued at - boolean issuedAtRequired = claims.getExpiryTime() == null; - if (issuedAtRequired) { - JwtUtils.validateJwtIssuedAt(claims, ttl, clockOffset, issuedAtRequired); - } - } private static void validateJwtSubjectAndAudience(JwtClaims claims, Client c) { if (claims.getSubject() == null || !claims.getSubject().equals(c.getClientId())) { throw new SecurityException("Invalid subject"); } // validate audience - String aud = claims.getAudience(); - if (aud == null - || !c.getRegisteredAudiences().isEmpty() && !c.getRegisteredAudiences().contains(aud)) { + List<String> audiences = claims.getAudiences(); + if (audiences.isEmpty()) { throw new SecurityException("Invalid audience"); } + + if (!c.getRegisteredAudiences().isEmpty()) { + boolean match = false; + for (String audience : audiences) { + if (c.getRegisteredAudiences().contains(audience)) { + match = true; + break; + } + } + if (!match) { + throw new SecurityException("Invalid audience"); + } + } // TODO: the issuer is indirectly validated by validating the signature // but an extra check can be done } http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/AbstractTokenValidator.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/AbstractTokenValidator.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/AbstractTokenValidator.java index 6011577..8fc0022 100644 --- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/AbstractTokenValidator.java +++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/AbstractTokenValidator.java @@ -18,6 +18,7 @@ */ package org.apache.cxf.rs.security.oidc.rp; +import java.util.List; import java.util.concurrent.ConcurrentHashMap; import org.apache.cxf.jaxrs.client.WebClient; @@ -66,8 +67,9 @@ public abstract class AbstractTokenValidator extends AbstractOAuthJoseJwtConsume throw new SecurityException("Invalid subject"); } // validate audience - String aud = claims.getAudience(); - if (aud == null && validateClaimsAlways || aud != null && !clientId.equals(aud)) { + List<String> audiences = claims.getAudiences(); + if (audiences.isEmpty() && validateClaimsAlways + || !audiences.isEmpty() && !audiences.contains(clientId)) { throw new SecurityException("Invalid audience"); } http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/IdTokenReader.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/IdTokenReader.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/IdTokenReader.java index 4c9071c..27ce275 100644 --- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/IdTokenReader.java +++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/IdTokenReader.java @@ -42,6 +42,9 @@ public class IdTokenReader extends AbstractTokenValidator { } public JwtToken getIdJwtToken(String idJwtToken, Consumer client) { JwtToken jwt = getJwtToken(idJwtToken, client.getClientSecret()); + if (jwt.getClaims().getAudiences().size() > 1) { + throw new SecurityException("Invalid audience"); + } validateJwtClaims(jwt.getClaims(), client.getClientId(), true); return jwt; } http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/UserInfoClient.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/UserInfoClient.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/UserInfoClient.java index 62ff26c..a052d0a 100644 --- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/UserInfoClient.java +++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/UserInfoClient.java @@ -40,7 +40,7 @@ public class UserInfoClient extends AbstractTokenValidator { return getUserInfoFromJwt(jwt, idToken, client); } else { UserInfo profile = profileClient.get(UserInfo.class); - validateUserInfo(profile, idToken); + validateUserInfo(profile, idToken, client); return profile; } } else { @@ -50,7 +50,7 @@ public class UserInfoClient extends AbstractTokenValidator { return getUserInfoFromJwt(jwt, idToken, client); } else { UserInfo profile = profileClient.form(form).readEntity(UserInfo.class); - validateUserInfo(profile, idToken); + validateUserInfo(profile, idToken, client); return profile; } } @@ -59,18 +59,18 @@ public class UserInfoClient extends AbstractTokenValidator { IdToken idToken, Consumer client) { JwtToken jwt = getUserInfoJwt(profileJwtToken, client); - return getUserInfoFromJwt(jwt, idToken); + return getUserInfoFromJwt(jwt, idToken, client); } - public UserInfo getUserInfoFromJwt(JwtToken jwt, IdToken idToken) { + public UserInfo getUserInfoFromJwt(JwtToken jwt, IdToken idToken, Consumer client) { UserInfo profile = new UserInfo(jwt.getClaims().asMap()); - validateUserInfo(profile, idToken); + validateUserInfo(profile, idToken, client); return profile; } public JwtToken getUserInfoJwt(String profileJwtToken, Consumer client) { return getJwtToken(profileJwtToken); } - public void validateUserInfo(UserInfo profile, IdToken idToken) { - validateJwtClaims(profile, idToken.getAudience(), false); + public void validateUserInfo(UserInfo profile, IdToken idToken, Consumer client) { + validateJwtClaims(profile, client.getClientId(), false); // validate subject if (!idToken.getSubject().equals(profile.getSubject())) { throw new SecurityException("Invalid subject"); http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAlgorithmTest.java ---------------------------------------------------------------------- diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAlgorithmTest.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAlgorithmTest.java index 4b66f35..250e3a2 100644 --- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAlgorithmTest.java +++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAlgorithmTest.java @@ -92,6 +92,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -131,6 +132,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -173,6 +175,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -214,6 +217,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -256,6 +260,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -295,6 +300,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -331,6 +337,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -370,6 +377,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -405,6 +413,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -442,6 +451,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -482,6 +492,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -519,6 +530,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -554,6 +566,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -588,6 +601,7 @@ public class JWTAlgorithmTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); http://git-wip-us.apache.org/repos/asf/cxf/blob/3a698146/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAuthnAuthzTest.java ---------------------------------------------------------------------- diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAuthnAuthzTest.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAuthnAuthzTest.java index 7f62b83..45d109d 100644 --- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAuthnAuthzTest.java +++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwt/JWTAuthnAuthzTest.java @@ -84,6 +84,7 @@ public class JWTAuthnAuthzTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -123,6 +124,7 @@ public class JWTAuthnAuthzTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -160,6 +162,7 @@ public class JWTAuthnAuthzTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); // The endpoint requires a role of "boss" claims.setProperty("role", "boss"); @@ -201,6 +204,7 @@ public class JWTAuthnAuthzTest extends AbstractBusClientServerTestBase { claims.setSubject("alice"); claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); + claims.setAudience(address); JwtToken token = new JwtToken(claims); @@ -237,6 +241,7 @@ public class JWTAuthnAuthzTest extends AbstractBusClientServerTestBase { claims.setIssuer("DoubleItSTSIssuer"); claims.setIssuedAt(new Date().getTime() / 1000L); claims.setProperty("role", "manager"); + claims.setAudience(address); JwtToken token = new JwtToken(claims);
