Repository: SAP/cloud-security-xsuaa-integration
Pull request #60 (2019-03-18 18:12:16)

Broker fix
* Broker plan validation failed due to incorrect audience validation


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9113d93..d8ab4919 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,8 @@
 # Change Log 
 
 All notable changes to this project will be documented in this file.
+## 1.3.1
+* Broker plan validation failed due to incorrect audience validation
 ## 1.3.0
 * JwtGenerator offers enhancement options: custom claims and audience
 * Test framework support for multi tenancy
diff --git a/api/pom.xml b/api/pom.xml
index 1b82c772..f2f36a8a 100644
--- a/api/pom.xml
+++ b/api/pom.xml
@@ -4,12 +4,12 @@
 
 	<groupId>com.sap.cloud.security.xsuaa</groupId>
 	<artifactId>api</artifactId>
-	<version>1.3.0</version>
+	<version>1.3.1</version>
 
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>1.3.0</version>
+		<version>1.3.1</version>
 	</parent>
 
 	<packaging>jar</packaging>
diff --git a/pom.xml b/pom.xml
index 66476344..ec3edcab 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
 
 	<groupId>com.sap.cloud.security.xsuaa</groupId>
 	<artifactId>parent</artifactId>
-	<version>1.3.0</version>
+	<version>1.3.1</version>
 	<packaging>pom</packaging>
 
 	<name>parent</name>
@@ -113,7 +113,7 @@
 						<plugin>
 							<groupId>net.revelc.code</groupId>
 							<artifactId>impsort-maven-plugin</artifactId>
-							<version>1.3.0</version>
+							<version>1.3.1</version>
 							<configuration>
 								<groups>java.,javax.,org.,com.</groups>
 								<staticGroups>java,*</staticGroups>
diff --git a/samples/sap-java-buildpack-api-usage/pom.xml b/samples/sap-java-buildpack-api-usage/pom.xml
index aecdf0bd..042f121a 100755
--- a/samples/sap-java-buildpack-api-usage/pom.xml
+++ b/samples/sap-java-buildpack-api-usage/pom.xml
@@ -21,7 +21,7 @@
 		<dependency>
 			<groupId>com.sap.cloud.security.xsuaa</groupId>
 			<artifactId>api</artifactId>
-			<version>1.3.0</version>
+			<version>1.3.1</version>
 			<scope>provided</scope>
 		</dependency>
 		<!-- https://mvnrepository.com/artifact/javax.servlet/javax.servlet-api -->
diff --git a/samples/spring-security-basic-auth/pom.xml b/samples/spring-security-basic-auth/pom.xml
index 5516c18d..76aa7b1f 100644
--- a/samples/spring-security-basic-auth/pom.xml
+++ b/samples/spring-security-basic-auth/pom.xml
@@ -11,7 +11,7 @@
 	</parent>
 
 	<artifactId>spring-security-basic-auth</artifactId>
-	<version>1.3.0</version>
+	<version>1.3.1</version>
 	<name>spring-security-basic-auth</name>
 
 	<properties>
@@ -40,7 +40,7 @@
 		<dependency>
 			<groupId>com.sap.cloud.security.xsuaa</groupId>
 			<artifactId>spring-xsuaa</artifactId>
-			<version>1.3.0</version>
+			<version>1.3.1</version>
 		</dependency>
 	</dependencies>
 
diff --git a/samples/spring-security-xsuaa-usage/pom.xml b/samples/spring-security-xsuaa-usage/pom.xml
index 14867789..69fd700e 100644
--- a/samples/spring-security-xsuaa-usage/pom.xml
+++ b/samples/spring-security-xsuaa-usage/pom.xml
@@ -11,7 +11,7 @@
 	</parent>
 
 	<artifactId>spring-security-xsuaa-usage</artifactId>
-	<version>1.3.0</version>
+	<version>1.3.1</version>
 	<name>spring-security-xsuaa-usage</name>
 
 	<properties>
@@ -40,7 +40,7 @@
 		<dependency>
 			<groupId>com.sap.cloud.security.xsuaa</groupId>
 			<artifactId>spring-xsuaa</artifactId>
-			<version>1.3.0</version>
+			<version>1.3.1</version>
 		</dependency>
 	</dependencies>
 
diff --git a/spring-xsuaa-it/pom.xml b/spring-xsuaa-it/pom.xml
index 01136390..9b92193d 100644
--- a/spring-xsuaa-it/pom.xml
+++ b/spring-xsuaa-it/pom.xml
@@ -11,7 +11,7 @@
 	</parent>
 
 	<artifactId>spring-xsuaa-it</artifactId>
-	<version>1.3.0</version>
+	<version>1.3.1</version>
 	<name>spring-xsuaa-it</name>
 
 	<properties>
diff --git a/spring-xsuaa-mock/pom.xml b/spring-xsuaa-mock/pom.xml
index 7b5acf55..f526e126 100644
--- a/spring-xsuaa-mock/pom.xml
+++ b/spring-xsuaa-mock/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>1.3.0</version>
+		<version>1.3.1</version>
 	</parent>
 
 	<artifactId>spring-xsuaa-mock</artifactId>
diff --git a/spring-xsuaa/pom.xml b/spring-xsuaa/pom.xml
index b5efed1a..d8ca4c8d 100644
--- a/spring-xsuaa/pom.xml
+++ b/spring-xsuaa/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>1.3.0</version>
+		<version>1.3.1</version>
 	</parent>
 
 	<artifactId>spring-xsuaa</artifactId>
diff --git a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java
index 581261a7..9f9dc55b 100644
--- a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java
+++ b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java
@@ -26,8 +26,11 @@ public class XsuaaAudienceValidator implements OAuth2TokenValidator<Jwt> {
 
 	@Override
 	public OAuth2TokenValidatorResult validate(Jwt token) {
-		// case 1 : token issued by own client
-		if (xsuaaServiceConfiguration.getClientId().equals(token.getClaimAsString("client_id"))) {
+		// case 1 : token issued by own client (or master)
+		if (xsuaaServiceConfiguration.getClientId().equals(token.getClaimAsString("client_id"))
+				|| (xsuaaServiceConfiguration.getAppId().contains("!b")
+						&& token.getClaimAsString("client_id").contains("|")
+						&& token.getClaimAsString("client_id").endsWith("|" + xsuaaServiceConfiguration.getAppId()))) {
 			return OAuth2TokenValidatorResult.success();
 		} else {
 			// case 2: foreign token


Test patch:
diff --git a/spring-xsuaa-test/pom.xml b/spring-xsuaa-test/pom.xml
index f989e02b..143ed2ec 100644
--- a/spring-xsuaa-test/pom.xml
+++ b/spring-xsuaa-test/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>1.3.0</version>
+		<version>1.3.1</version>
 	</parent>
 
 	<artifactId>spring-xsuaa-test</artifactId>
diff --git a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorTest.java b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorTest.java
index 4be1da91..9d70ebfd 100644
--- a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorTest.java
+++ b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidatorTest.java
@@ -20,9 +20,14 @@ public class XsuaaAudienceValidatorTest {
 
 	private Jwt tokenWithAudience;
 	private Jwt tokenWithoutAudience;
+	private Jwt cloneTokenWithoutAudience;
+	private Jwt cloneTokenWithAudience;
+
 	private XsuaaServiceConfiguration serviceConfigurationSameClientId;
 	private XsuaaServiceConfiguration serviceConfigurationOtherGrantedClientId;
 	private XsuaaServiceConfiguration serviceConfigurationUnGrantedClientId;
+	private XsuaaServiceConfiguration serviceConfigurationBrokerPlan;
+
 	private JWTClaimsSet.Builder claimsBuilder;
 
 	@Before
@@ -30,9 +35,11 @@ public class XsuaaAudienceValidatorTest {
 		serviceConfigurationSameClientId = new DummyXsuaaServiceConfiguration("sb-test1!t1", "test1!t1");
 		serviceConfigurationOtherGrantedClientId = new DummyXsuaaServiceConfiguration("sb-test2!t1", "test2!t1");
 		serviceConfigurationUnGrantedClientId = new DummyXsuaaServiceConfiguration("sb-test3!t1", "test3!t1");
-
+		serviceConfigurationBrokerPlan = new DummyXsuaaServiceConfiguration("sb-test3!b1", "test3!b1");
 		tokenWithAudience = new JwtGenerator().createFromTemplate("/audience_1.txt");
 		tokenWithoutAudience = new JwtGenerator().createFromTemplate("/audience_2.txt");
+		cloneTokenWithAudience = new JwtGenerator().createFromTemplate("/audience_3.txt");
+		cloneTokenWithoutAudience = new JwtGenerator().createFromTemplate("/audience_4.txt");
 
 		claimsBuilder = new JWTClaimsSet.Builder().issueTime(new Date()).expirationTime(JwtGenerator.NO_EXPIRE_DATE);
 	}
@@ -120,6 +127,20 @@ public class XsuaaAudienceValidatorTest {
 		Assert.assertTrue(result.hasErrors());
 	}
 
+	@Test
+	public void testBrokerCloneWithAudience() {
+		OAuth2TokenValidatorResult result = new XsuaaAudienceValidator(serviceConfigurationBrokerPlan)
+				.validate(cloneTokenWithAudience);
+		Assert.assertFalse(result.hasErrors());
+	}
+
+	@Test
+	public void testBrokerCloneWithoutAudience() {
+		OAuth2TokenValidatorResult result = new XsuaaAudienceValidator(serviceConfigurationBrokerPlan)
+				.validate(cloneTokenWithAudience);
+		Assert.assertFalse(result.hasErrors());
+	}
+
 	class DummyXsuaaServiceConfiguration implements XsuaaServiceConfiguration {
 
 		String clientId;
diff --git a/spring-xsuaa/src/test/resources/audience_3.txt b/spring-xsuaa/src/test/resources/audience_3.txt
new file mode 100644
index 00000000..37336b70
--- /dev/null
+++ b/spring-xsuaa/src/test/resources/audience_3.txt
@@ -0,0 +1,12 @@
+{
+ "client_id":"sb-clone1!b22|test3!b1",
+ "exp":$exp,
+ "scope":["test1!t1.read","test2!t1.write"],
+ "user_name":"testUser",
+ "user_id":"1234",
+ "email":"testUser@testOrg",
+ "zid":"demo",
+ "grant_type":"password",
+ "aud":["b22|test3!b1.read"],
+ "iat": 1532416849
+}
\ No newline at end of file
diff --git a/spring-xsuaa/src/test/resources/audience_4.txt b/spring-xsuaa/src/test/resources/audience_4.txt
new file mode 100644
index 00000000..221954ea
--- /dev/null
+++ b/spring-xsuaa/src/test/resources/audience_4.txt
@@ -0,0 +1,12 @@
+{
+ "client_id":"sb-clone1!b22|test3!b1",
+ "exp":$exp,
+ "scope":["test1!t1.read","test2!t1.write"],
+ "user_name":"testUser",
+ "user_id":"1234",
+ "email":"testUser@testOrg",
+ "zid":"demo",
+ "grant_type":"password",
+ "aud":[],
+ "iat": 1532416849
+}
\ No newline at end of file