[OLTU-161] JWTClaimsSetParser fails when aud is an array

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: oauth2-1.0.0
• Fix Version/s: oauth2-1.0.1
• Component/s: oauth2-jwt
• Assignee: Simone Tripodi
• Reporter: Stefan Bodewig
• Created: 16/Sep/14 09:20
• Updated: 07/Oct/14 09:05
• Resolved: 07/Oct/14 09:05

Description

JWTClaimsSetParser contains

        if (AUDIENCE.equals(key)) {
            getBuilder().setClaimsSetAudience(String.valueOf(value));

which leads to something like "aud": "[Ljava.lang.Object;@34657d74" when the audience provided by the server is a JSON array - which is the canonical representation and a single string is only the exception according to http://openid.net/specs/openid-connect-core-1_0.html#IDToken