@Test public void testTokenWithWrongArrayAudience() throws Exception { OidcTenantConfig.Token tokenClaims = OidcTenantConfig.Token.fromAudience("service_client_id"); InputStream is = getClass().getResourceAsStream("/tokenArrayAudience.json"); try { OidcUtils.validateClaims(tokenClaims, read(is)); fail("Exception expected: wrong array audience"); } catch (OIDCException ex) { } }
public static boolean validateClaims(OidcTenantConfig.Token tokenConfig, JsonObject json) { if (tokenConfig.issuer.isPresent()) { String issuer = json.getString(Claims.iss.name()); if (!tokenConfig.issuer.get().equals(issuer)) { throw new OIDCException("Invalid issuer"); } } if (tokenConfig.audience.isPresent()) { Object claimValue = json.getValue(Claims.aud.name()); List<String> audience = Collections.emptyList(); if (claimValue instanceof JsonArray) { audience = convertJsonArrayToList((JsonArray) claimValue); } else if (claimValue != null) { audience = Arrays.asList((String) claimValue); } if (!audience.containsAll(tokenConfig.audience.get())) { throw new OIDCException("Invalid audience"); } } return true; }
OidcUtils { public static boolean validateClaims(OidcTenantConfig.Token tokenConfig, JsonObject json) { if (tokenConfig.issuer.isPresent()) { String issuer = json.getString(Claims.iss.name()); if (!tokenConfig.issuer.get().equals(issuer)) { throw new OIDCException("Invalid issuer"); } } if (tokenConfig.audience.isPresent()) { Object claimValue = json.getValue(Claims.aud.name()); List<String> audience = Collections.emptyList(); if (claimValue instanceof JsonArray) { audience = convertJsonArrayToList((JsonArray) claimValue); } else if (claimValue != null) { audience = Arrays.asList((String) claimValue); } if (!audience.containsAll(tokenConfig.audience.get())) { throw new OIDCException("Invalid audience"); } } return true; } }
OidcUtils { public static boolean validateClaims(OidcTenantConfig.Token tokenConfig, JsonObject json) { if (tokenConfig.issuer.isPresent()) { String issuer = json.getString(Claims.iss.name()); if (!tokenConfig.issuer.get().equals(issuer)) { throw new OIDCException("Invalid issuer"); } } if (tokenConfig.audience.isPresent()) { Object claimValue = json.getValue(Claims.aud.name()); List<String> audience = Collections.emptyList(); if (claimValue instanceof JsonArray) { audience = convertJsonArrayToList((JsonArray) claimValue); } else if (claimValue != null) { audience = Arrays.asList((String) claimValue); } if (!audience.containsAll(tokenConfig.audience.get())) { throw new OIDCException("Invalid audience"); } } return true; } private  OidcUtils(); }
OidcUtils { public static boolean validateClaims(OidcTenantConfig.Token tokenConfig, JsonObject json) { if (tokenConfig.issuer.isPresent()) { String issuer = json.getString(Claims.iss.name()); if (!tokenConfig.issuer.get().equals(issuer)) { throw new OIDCException("Invalid issuer"); } } if (tokenConfig.audience.isPresent()) { Object claimValue = json.getValue(Claims.aud.name()); List<String> audience = Collections.emptyList(); if (claimValue instanceof JsonArray) { audience = convertJsonArrayToList((JsonArray) claimValue); } else if (claimValue != null) { audience = Arrays.asList((String) claimValue); } if (!audience.containsAll(tokenConfig.audience.get())) { throw new OIDCException("Invalid audience"); } } return true; } private  OidcUtils(); static boolean isOpaqueToken(String token); static JsonObject decodeJwtContent(String jwt); static boolean validateClaims(OidcTenantConfig.Token tokenConfig, JsonObject json); static List<String> findRoles(String clientId, OidcTenantConfig.Roles rolesConfig, JsonObject json); static void setSecurityIdentityRoles(QuarkusSecurityIdentity.Builder builder, OidcTenantConfig config,
            JsonObject rolesJson); static void setBlockinApiAttribute(QuarkusSecurityIdentity.Builder builder, RoutingContext vertxContext); static void setTenantIdAttribute(QuarkusSecurityIdentity.Builder builder, OidcTenantConfig config); static void setSecurityIdentityUserInfo(QuarkusSecurityIdentity.Builder builder, JsonObject userInfo); static void validatePrimaryJwtTokenType(OidcTenantConfig.Token tokenConfig, JsonObject tokenJson); }
OidcUtils { public static boolean validateClaims(OidcTenantConfig.Token tokenConfig, JsonObject json) { if (tokenConfig.issuer.isPresent()) { String issuer = json.getString(Claims.iss.name()); if (!tokenConfig.issuer.get().equals(issuer)) { throw new OIDCException("Invalid issuer"); } } if (tokenConfig.audience.isPresent()) { Object claimValue = json.getValue(Claims.aud.name()); List<String> audience = Collections.emptyList(); if (claimValue instanceof JsonArray) { audience = convertJsonArrayToList((JsonArray) claimValue); } else if (claimValue != null) { audience = Arrays.asList((String) claimValue); } if (!audience.containsAll(tokenConfig.audience.get())) { throw new OIDCException("Invalid audience"); } } return true; } private  OidcUtils(); static boolean isOpaqueToken(String token); static JsonObject decodeJwtContent(String jwt); static boolean validateClaims(OidcTenantConfig.Token tokenConfig, JsonObject json); static List<String> findRoles(String clientId, OidcTenantConfig.Roles rolesConfig, JsonObject json); static void setSecurityIdentityRoles(QuarkusSecurityIdentity.Builder builder, OidcTenantConfig config,
            JsonObject rolesJson); static void setBlockinApiAttribute(QuarkusSecurityIdentity.Builder builder, RoutingContext vertxContext); static void setTenantIdAttribute(QuarkusSecurityIdentity.Builder builder, OidcTenantConfig config); static void setSecurityIdentityUserInfo(QuarkusSecurityIdentity.Builder builder, JsonObject userInfo); static void validatePrimaryJwtTokenType(OidcTenantConfig.Token tokenConfig, JsonObject tokenJson);  }