(syncope) branch 4_0_X updated: Checking that AccessToken owner matches JWT subject for non-admin users

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch 4_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/4_0_X by this push:
     new 0230660921 Checking that AccessToken owner matches JWT subject for 
non-admin users
0230660921 is described below

commit 023066092152a07b27628a6a4ee6de5b1012c777
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Wed Sep 9 11:20:34 2026 +0200

    Checking that AccessToken owner matches JWT subject for non-admin users
---
 .../apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java    | 4 ++++
 1 file changed, 4 insertions(+)

diff --git 
a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java
 
b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java
index 1c181400cb..278c09d4f2 100644
--- 
a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java
+++ 
b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java
@@ -102,6 +102,10 @@ public class SyncopeJWTSSOProvider implements 
JWTSSOProvider {
                 orElseThrow(() -> new 
AuthenticationCredentialsNotFoundException(
                         "Could not find an Access Token for JWT " + 
jwtClaims.getJWTID()));
 
+        if (!jwtClaims.getSubject().equals(accessToken.getOwner())) {
+            throw new AuthenticationCredentialsNotFoundException("Access Token 
owner does not match JWT subject");
+        }
+
         Set<SyncopeGrantedAuthority> authorities = new HashSet<>();
         if (accessToken.getAuthorities() != null) {
             try {