(syncope) branch 4_1_X updated: Checking that AccessToken owner matches JWT subject for non-admin users

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch 4_1_X
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/4_1_X by this push:
     new a63d937799 Checking that AccessToken owner matches JWT subject for 
non-admin users
a63d937799 is described below

commit a63d9377991ec51b75137c7f526f7cd6fff9c5a4
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Wed Sep 9 11:20:34 2026 +0200

    Checking that AccessToken owner matches JWT subject for non-admin users
---
 .../apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java    | 4 ++++
 1 file changed, 4 insertions(+)

diff --git 
a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java
 
b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java
index 8436a5b25a..4a8000da53 100644
--- 
a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java
+++ 
b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java
@@ -102,6 +102,10 @@ public class SyncopeJWTSSOProvider implements 
JWTSSOProvider {
                 orElseThrow(() -> new 
AuthenticationCredentialsNotFoundException(
                         "Could not find an Access Token for JWT " + 
jwtClaims.getJWTID()));
 
+        if (!jwtClaims.getSubject().equals(accessToken.getOwner())) {
+            throw new AuthenticationCredentialsNotFoundException("Access Token 
owner does not match JWT subject");
+        }
+
         Set<SyncopeGrantedAuthority> authorities = new HashSet<>();
         if (accessToken.getAuthorities() != null) {
             try {