Andrea Cosentino created CAMEL-26404:
----------------------------------------
Summary: camel-oauth: validate audience and authorized party
claims for access tokens in UserProfile
Key: CAMEL-26404
URL: https://issues.apache.org/jira/browse/CAMEL-26404
Project: Camel
Issue Type: Bug
Components: camel-oauth
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0, 4.22.3, 4.18.6
h3. Current behaviour
In {{org.apache.camel.oauth.UserProfile.verifyToken}} (camel-oauth), the
validation checks for {{aud}} (audience) and {{azp}} (authorized party) claims
are guarded by the {{idToken}} flag:
{code:java}
String clientId = config.getClientId();
if (idToken && !targetAudience.contains(clientId)) {
throw new OAuthException("Invalid JWT audience. Expected to contain: " +
clientId);
}
if (idToken && tokenJwt.has("azp")) {
String authorizedParty = tokenJwt.get("azp").getAsString();
if (!authorizedParty.equals(clientId)) {
throw new OAuthException("Invalid authorized party != config.clientID");
}
if (!targetAudience.contains(authorizedParty)) {
throw new OAuthException("ID Token audience, doesn't contain authorized
party");
}
}
{code}
When verifying access tokens (such as incoming bearer tokens evaluated by
{{OAuthBearerTokenProcessor}} via {{ServletOAuth}}), {{idToken}} is false.
Consequently, {{targetAudience}} is parsed from the token, but is not evaluated
against the configured client ID or {{JWTOptions.getAudience()}}. In addition,
the {{azp}} claim is not evaluated for access tokens.
h3. Expected behaviour
* {{UserProfile.verifyToken}} should validate the {{aud}} claim for access
tokens as well as ID tokens against expected audiences (such as
{{JWTOptions.getAudience()}} or {{config.getClientId()}}).
* When {{azp}} is present on an access token, it should be validated against
the authorized client.
* Access tokens with mismatched audience should be rejected.
h3. Change
* Update {{UserProfile.verifyToken}} to validate {{targetAudience}} and {{azp}}
on access tokens.
* Support checking against configured expected audiences from
{{JWTOptions.getAudience()}} or {{config.getClientId()}}.
* Add unit test coverage in {{UserProfileTest}} and
{{ServletOAuthTokenCredentialsTest}} verifying audience and authorized party
validation on access tokens.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
