[
https://issues.apache.org/jira/browse/CAMEL-26404?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino resolved CAMEL-26404.
--------------------------------------
Resolution: Fixed
Fixed in main via https://github.com/apache/camel/pull/28689
> camel-oauth: validate audience and authorized party claims for access tokens
> in UserProfile
> -------------------------------------------------------------------------------------------
>
> Key: CAMEL-26404
> URL: https://issues.apache.org/jira/browse/CAMEL-26404
> Project: Camel
> Issue Type: Bug
> Components: camel-oauth
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> h3. Current behaviour
> In {{org.apache.camel.oauth.UserProfile.verifyToken}} (camel-oauth), the
> validation checks for {{aud}} (audience) and {{azp}} (authorized party)
> claims are guarded by the {{idToken}} flag:
> {code:java}
> String clientId = config.getClientId();
> if (idToken && !targetAudience.contains(clientId)) {
> throw new OAuthException("Invalid JWT audience. Expected to contain: " +
> clientId);
> }
> if (idToken && tokenJwt.has("azp")) {
> String authorizedParty = tokenJwt.get("azp").getAsString();
> if (!authorizedParty.equals(clientId)) {
> throw new OAuthException("Invalid authorized party !=
> config.clientID");
> }
> if (!targetAudience.contains(authorizedParty)) {
> throw new OAuthException("ID Token audience, doesn't contain
> authorized party");
> }
> }
> {code}
> When verifying access tokens (such as incoming bearer tokens evaluated by
> {{OAuthBearerTokenProcessor}} via {{ServletOAuth}}), {{idToken}} is false.
> Consequently, {{targetAudience}} is parsed from the token, but is not
> evaluated against the configured client ID or {{JWTOptions.getAudience()}}.
> In addition, the {{azp}} claim is not evaluated for access tokens.
> h3. Expected behaviour
> * {{UserProfile.verifyToken}} should validate the {{aud}} claim for access
> tokens as well as ID tokens against expected audiences (such as
> {{JWTOptions.getAudience()}} or {{config.getClientId()}}).
> * When {{azp}} is present on an access token, it should be validated against
> the authorized client.
> * Access tokens with mismatched audience should be rejected.
> h3. Change
> * Update {{UserProfile.verifyToken}} to validate {{targetAudience}} and
> {{azp}} on access tokens.
> * Support checking against configured expected audiences from
> {{JWTOptions.getAudience()}} or {{config.getClientId()}}.
> * Add unit test coverage in {{UserProfileTest}} and
> {{ServletOAuthTokenCredentialsTest}} verifying audience and authorized party
> validation on access tokens.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
