@Test public void testOtherGrantedClientIdWithoutAudienceAndEmptyScopes() { claimsBuilder.claim(TokenClaims.CLAIM_SCOPES, "[]"); Jwt tokenWithoutAudienceAndScopes = JwtGenerator.createFromClaims(claimsBuilder.build()); OAuth2TokenValidatorResult result = new XsuaaAudienceValidator(serviceConfigurationOtherGrantedClientId) .validate(tokenWithoutAudienceAndScopes); Assert.assertTrue(result.hasErrors()); }
@Override public OAuth2TokenValidatorResult validate(Jwt token) { String tokenClientId = token.getClaimAsString(TokenClaims.CLAIM_CLIENT_ID); if (StringUtils.isEmpty(tokenClientId)) { return OAuth2TokenValidatorResult.failure( new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, "Jwt token must contain 'cid' (client_id)", null)); } final Set<String> allowedAudiences = getAllowedAudiences(token); for (Map.Entry<String, String> xsuaaConfig : appIdClientIdMap.entrySet()) { if (checkMatch(xsuaaConfig.getKey(), xsuaaConfig.getValue(), tokenClientId, allowedAudiences)) { return OAuth2TokenValidatorResult.success(); } } final String description = String.format("Jwt token with allowed audiences %s matches none of these: %s", allowedAudiences, appIdClientIdMap.keySet().toString()); return OAuth2TokenValidatorResult.failure(new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, description, null)); }
XsuaaAudienceValidator implements OAuth2TokenValidator<Jwt> { @Override public OAuth2TokenValidatorResult validate(Jwt token) { String tokenClientId = token.getClaimAsString(TokenClaims.CLAIM_CLIENT_ID); if (StringUtils.isEmpty(tokenClientId)) { return OAuth2TokenValidatorResult.failure( new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, "Jwt token must contain 'cid' (client_id)", null)); } final Set<String> allowedAudiences = getAllowedAudiences(token); for (Map.Entry<String, String> xsuaaConfig : appIdClientIdMap.entrySet()) { if (checkMatch(xsuaaConfig.getKey(), xsuaaConfig.getValue(), tokenClientId, allowedAudiences)) { return OAuth2TokenValidatorResult.success(); } } final String description = String.format("Jwt token with allowed audiences %s matches none of these: %s", allowedAudiences, appIdClientIdMap.keySet().toString()); return OAuth2TokenValidatorResult.failure(new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, description, null)); } }
XsuaaAudienceValidator implements OAuth2TokenValidator<Jwt> { @Override public OAuth2TokenValidatorResult validate(Jwt token) { String tokenClientId = token.getClaimAsString(TokenClaims.CLAIM_CLIENT_ID); if (StringUtils.isEmpty(tokenClientId)) { return OAuth2TokenValidatorResult.failure( new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, "Jwt token must contain 'cid' (client_id)", null)); } final Set<String> allowedAudiences = getAllowedAudiences(token); for (Map.Entry<String, String> xsuaaConfig : appIdClientIdMap.entrySet()) { if (checkMatch(xsuaaConfig.getKey(), xsuaaConfig.getValue(), tokenClientId, allowedAudiences)) { return OAuth2TokenValidatorResult.success(); } } final String description = String.format("Jwt token with allowed audiences %s matches none of these: %s", allowedAudiences, appIdClientIdMap.keySet().toString()); return OAuth2TokenValidatorResult.failure(new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, description, null)); } XsuaaAudienceValidator(XsuaaServiceConfiguration xsuaaServiceConfiguration); }
XsuaaAudienceValidator implements OAuth2TokenValidator<Jwt> { @Override public OAuth2TokenValidatorResult validate(Jwt token) { String tokenClientId = token.getClaimAsString(TokenClaims.CLAIM_CLIENT_ID); if (StringUtils.isEmpty(tokenClientId)) { return OAuth2TokenValidatorResult.failure( new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, "Jwt token must contain 'cid' (client_id)", null)); } final Set<String> allowedAudiences = getAllowedAudiences(token); for (Map.Entry<String, String> xsuaaConfig : appIdClientIdMap.entrySet()) { if (checkMatch(xsuaaConfig.getKey(), xsuaaConfig.getValue(), tokenClientId, allowedAudiences)) { return OAuth2TokenValidatorResult.success(); } } final String description = String.format("Jwt token with allowed audiences %s matches none of these: %s", allowedAudiences, appIdClientIdMap.keySet().toString()); return OAuth2TokenValidatorResult.failure(new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, description, null)); } XsuaaAudienceValidator(XsuaaServiceConfiguration xsuaaServiceConfiguration); void configureAnotherXsuaaInstance(String appId, String clientId); @Override OAuth2TokenValidatorResult validate(Jwt token); }
XsuaaAudienceValidator implements OAuth2TokenValidator<Jwt> { @Override public OAuth2TokenValidatorResult validate(Jwt token) { String tokenClientId = token.getClaimAsString(TokenClaims.CLAIM_CLIENT_ID); if (StringUtils.isEmpty(tokenClientId)) { return OAuth2TokenValidatorResult.failure( new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, "Jwt token must contain 'cid' (client_id)", null)); } final Set<String> allowedAudiences = getAllowedAudiences(token); for (Map.Entry<String, String> xsuaaConfig : appIdClientIdMap.entrySet()) { if (checkMatch(xsuaaConfig.getKey(), xsuaaConfig.getValue(), tokenClientId, allowedAudiences)) { return OAuth2TokenValidatorResult.success(); } } final String description = String.format("Jwt token with allowed audiences %s matches none of these: %s", allowedAudiences, appIdClientIdMap.keySet().toString()); return OAuth2TokenValidatorResult.failure(new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, description, null)); } XsuaaAudienceValidator(XsuaaServiceConfiguration xsuaaServiceConfiguration); void configureAnotherXsuaaInstance(String appId, String clientId); @Override OAuth2TokenValidatorResult validate(Jwt token);  }