[CXF-7693] Allow JWT audience claims validation not RFC 7519 compliant

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.2.4
• Fix Version/s: 3.1.16, 3.2.5
• Component/s: JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Jo Evans
• Created: 30/Mar/18 12:11
• Updated: 25/Mar/19 12:28
• Resolved: 04/Apr/18 09:11

Description

Current JwtUtils.validateJwtAudienceRestriction implementation does not comply with the 'aud' claim specification. An 'aud' claim is optional - the current validation does not cater for the case when the 'aud' claim is optional i.e. when no aud claims are present, the processing principal should be allowed to process if it so chooses.

 

Should perhaps also consider allowing explicit audiences vs wildcards i.e. allowing a resource to also include all its sub-resources - this would reduce the token size which does not scale well if the token has to contain multiple aud claims

Issue Links

• relates to: CXF-7696 Allow JWT aud claim to accept wildcards / nested resources