Repository: SAP/cloud-security-xsuaa-integration
Pull request #289 (2020-05-25 11:36:08)

Add allowed audiences
..to the validation result description in the audience validation in spring-xsuaa.


Patch:
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 8de2a014..5919b87c 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           java-version: 1.8
       - name: Build with Maven
-        run: mvn -B package --file pom.xml
+        run: mvn -B install --file pom.xml
       - name: Build spring-security-basic-auth
         run: cd samples/spring-security-basic-auth; mvn -B package --file pom.xml
       - name: Build spring-security-xsuaa-usage
diff --git a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java
index 1bc08b63..591a3daa 100644
--- a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java
+++ b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java
@@ -54,8 +54,9 @@ public class XsuaaAudienceValidator implements OAuth2TokenValidator<Jwt> {
 				return OAuth2TokenValidatorResult.success();
 			}
 		}
-		return OAuth2TokenValidatorResult.failure(new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT,
-				"Jwt token audience matches none of these: " + appIdClientIdMap.keySet().toString(), null));
+		String description = String.format("Jwt token with allowed audiences %s matches none of these: %s",
+				allowedAudiences, appIdClientIdMap.keySet().toString());
+		return OAuth2TokenValidatorResult.failure(new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT, description, null));
 	}
 
 	private boolean checkMatch(String appId, String clientId, String tokenClientId, List<String> allowedAudiences) {


Test patch:
diff --git a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorForCloneTokenTest.java b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorForCloneTokenTest.java
index 5fbf8503..50c0e9be 100644
--- a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorForCloneTokenTest.java
+++ b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorForCloneTokenTest.java
@@ -60,7 +60,7 @@ public class XsuaaAudienceValidatorForCloneTokenTest {
 
 		List<OAuth2Error> errors = new ArrayList<>(result.getErrors());
 		Assert.assertThat(errors.get(0).getDescription(),
-				is("Jwt token audience matches none of these: [test1!t1, brokerplanmasterapp!b123]"));
+				is("Jwt token with allowed audiences [] matches none of these: [test1!t1, brokerplanmasterapp!b123]"));
 		Assert.assertThat(errors.get(0).getErrorCode(), is(OAuth2ErrorCodes.INVALID_CLIENT));
 	}
 
diff --git a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorTest.java b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorTest.java
index 0cddf0a8..344f3ca6 100644
--- a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorTest.java
+++ b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorTest.java
@@ -125,7 +125,8 @@ public class XsuaaAudienceValidatorTest {
 				.validate(tokenWithoutAudienceButScopes);
 		Assert.assertTrue(result.hasErrors());
 		List<OAuth2Error> errors = new ArrayList<>(result.getErrors());
-		Assert.assertThat(errors.get(0).getDescription(), is("Jwt token audience matches none of these: [test2!t1]"));
+		String expectedDescription = "Jwt token with allowed audiences [test3!t1] matches none of these: [test2!t1]";
+		Assert.assertThat(errors.get(0).getDescription(), is(expectedDescription));
 		Assert.assertThat(errors.get(0).getErrorCode(), is(OAuth2ErrorCodes.INVALID_CLIENT));
 	}