Repository: SAP/cloud-security-xsuaa-integration
Pull request #319 (2020-06-30 12:01:16)

Ngpbug 120051
Audience Validation should validate to true when `client_id` of broker-clone token matches the trusted client. This is relevant to support tokens of grant type `user_token` that contains no scopes.


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e63ce9ca..7864d51c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,9 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.7.4
+- [java-security] 
+  - Audience Validation is skipped when `client_id` of broker-clone token matches the trusted client. This is relevant to support tokens of grant type `user_token` that contains no scopes.
+
 ## 2.7.3
 - [java-security] 
-  - Audience Validation is skipped when `client_id` of token matches the trusted client. This is relevant to support tokens of grant type `user_token` that contains no scopes.
+  - Audience Validation is skipped when `client_id` of token exactly matches the trusted client. This is relevant to support tokens of grant type `user_token` that contains no scopes.
   - provides the subaccount identifier from the `ext_attr` claim.
 - [spring-xsuaa] provides the subaccount identifier from the `ext_attr` claim.
 
diff --git a/api/pom.xml b/api/pom.xml
index dca00d4b..0a67c448 100644
--- a/api/pom.xml
+++ b/api/pom.xml
@@ -8,7 +8,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<packaging>jar</packaging>
diff --git a/java-api/pom.xml b/java-api/pom.xml
index a998aa61..640a4c31 100644
--- a/java-api/pom.xml
+++ b/java-api/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security/Migration_SAPJavaBuildpackProjects.md b/java-security/Migration_SAPJavaBuildpackProjects.md
index fb9b8fb2..6b2a2965 100644
--- a/java-security/Migration_SAPJavaBuildpackProjects.md
+++ b/java-security/Migration_SAPJavaBuildpackProjects.md
@@ -27,7 +27,7 @@ The above mentioned dependencies should be removed / replaced with this one:
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>api</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
     <scope>provided</scope> <!-- provided with buildpack -->
 </dependency>
 ```
diff --git a/java-security/Migration_SAPJavaBuildpackProjects_V2.md b/java-security/Migration_SAPJavaBuildpackProjects_V2.md
index 5b7318a7..f0f97b35 100644
--- a/java-security/Migration_SAPJavaBuildpackProjects_V2.md
+++ b/java-security/Migration_SAPJavaBuildpackProjects_V2.md
@@ -19,7 +19,7 @@ First make sure you have the following dependency defined in your pom.xml:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-api</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
     <scope>provided</scope> <!-- provided with buildpack -->
 </dependency>
 ```
@@ -29,7 +29,7 @@ Now you are ready to **remove** the dependency to the **`api`** by deleting the
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>api</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
     <scope>provided</scope>
 </dependency>
 ```
diff --git a/java-security/Migration_SpringSecurityProjects.md b/java-security/Migration_SpringSecurityProjects.md
index a02e17f8..13a6a155 100644
--- a/java-security/Migration_SpringSecurityProjects.md
+++ b/java-security/Migration_SpringSecurityProjects.md
@@ -37,19 +37,19 @@ First make sure you have the following dependencies defined in your pom.xml:
 <dependency>
   <groupId>com.sap.cloud.security.xsuaa</groupId>
   <artifactId>api</artifactId>
-  <version>2.7.3</version>
+  <version>2.7.4</version>
 </dependency>
 <dependency>
   <groupId>com.sap.cloud.security</groupId>
   <artifactId>java-security</artifactId>
-  <version>2.7.3</version>
+  <version>2.7.4</version>
 </dependency>
 
 <!-- new java-security dependencies for unit tests -->
 <dependency>
   <groupId>com.sap.cloud.security</groupId>
   <artifactId>java-security-test</artifactId>
-  <version>2.7.3</version>
+  <version>2.7.4</version>
   <scope>test</scope>
 </dependency>
 ```
diff --git a/java-security/README.md b/java-security/README.md
index 40cba8b1..7e088ec2 100644
--- a/java-security/README.md
+++ b/java-security/README.md
@@ -44,7 +44,7 @@ Token Validation for Java applications.
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-security</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
 </dependency>
 <dependency>
     <groupId>org.apache.httpcomponents</groupId>
diff --git a/java-security/pom.xml b/java-security/pom.xml
index 1eacbdcb..8225bf5a 100644
--- a/java-security/pom.xml
+++ b/java-security/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidator.java b/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidator.java
index 25657a70..b103c074 100644
--- a/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidator.java
+++ b/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidator.java
@@ -42,25 +42,15 @@ public class JwtAudienceValidator implements Validator<Token> {
 
 	@Override
 	public ValidationResult validate(Token token) {
-		Set<String> allowedAudiences = getAllowedAudiences(token);
+		Set<String> allowedAudiences = extractAudiencesFromToken(token);
 
-		if(validateSameClientId(token) || validateDefault(allowedAudiences)
+		if(validateDefault(allowedAudiences)
 				|| validateAudienceOfXsuaaBrokerClone(allowedAudiences)) {
 			return ValidationResults.createValid();
 		}
 		return ValidationResults.createInvalid(
 				"Jwt token with audience {} is not issued for these clientIds: {}.",
-				allowedAudiences, clientIds);
-	}
-
-	private boolean validateSameClientId(Token token) {
-		if(Service.XSUAA.equals(token.getService()) && token.hasClaim(TokenClaims.XSUAA.CLIENT_ID)) {
-			String clientId = token.getClaimAsString(TokenClaims.XSUAA.CLIENT_ID);
-			if(clientIds.contains(clientId)) {
-				return true;
-			}
-		}
-		return false;
+				token.getAudiences(), clientIds);
 	}
 
 	private boolean validateDefault(Set<String> allowedAudiences) {
@@ -76,7 +66,7 @@ public class JwtAudienceValidator implements Validator<Token> {
 		for (String configuredClientId : clientIds) {
 			if (configuredClientId.contains("!b")) {
 				for (String audience : allowedAudiences) {
-					if (audience.contains("|") && audience.endsWith("|" + configuredClientId)) {
+					if (audience.endsWith("|" + configuredClientId)) {
 						return true;
 					}
 				}
@@ -91,7 +81,7 @@ public class JwtAudienceValidator implements Validator<Token> {
 	 * @param token
 	 * @return (empty) list of audiences
 	 */
-	static Set<String> getAllowedAudiences(Token token) {
+	static Set<String> extractAudiencesFromToken(Token token) {
 		Set<String> audiences = new LinkedHashSet<>();
 
 		for (String audience : token.getAudiences()) {
@@ -106,14 +96,21 @@ public class JwtAudienceValidator implements Validator<Token> {
 				audiences.add(audience);
 			}
 		}
-		// extract audience (app-id) from scopes
-		if (audiences.isEmpty() && Service.XSUAA.equals(token.getService())) {
-			for (String scope : token.getClaimAsStringList(TokenClaims.XSUAA.SCOPES)) {
-				if (scope.contains(".")) {
-					audiences.add(extractAppId(scope));
+
+		if (Service.XSUAA.equals(token.getService())) {
+			if (token.hasClaim(TokenClaims.XSUAA.CLIENT_ID)) {
+				audiences.add(token.getClaimAsString(TokenClaims.XSUAA.CLIENT_ID));
+			}
+			// extract audience (app-id) from scopes
+			if (token.getAudiences().isEmpty()) {
+				for (String scope : token.getClaimAsStringList(TokenClaims.XSUAA.SCOPES)) {
+					if (scope.contains(".")) {
+						audiences.add(extractAppId(scope));
+					}
 				}
 			}
 		}
+		logger.info("The audiences that are derived from the token: {}.", audiences);
 		return audiences;
 	}
 
diff --git a/pom.xml b/pom.xml
index ede926bf..50507e55 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
 
 	<groupId>com.sap.cloud.security.xsuaa</groupId>
 	<artifactId>parent</artifactId>
-	<version>2.7.3</version>
+	<version>2.7.4</version>
 	<packaging>pom</packaging>
 
 	<name>parent</name>
diff --git a/samples/java-security-usage/pom.xml b/samples/java-security-usage/pom.xml
index bba21f36..1dfec4bc 100755
--- a/samples/java-security-usage/pom.xml
+++ b/samples/java-security-usage/pom.xml
@@ -3,13 +3,13 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.sap.cloud.security.xssec.samples</groupId>
     <artifactId>java-security-usage</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
     <packaging>jar</packaging>
 
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
-        <sap.cloud.security.version>2.7.3</sap.cloud.security.version>
+        <sap.cloud.security.version>2.7.4</sap.cloud.security.version>
         <slf4j.api.version>1.7.30</slf4j.api.version>
         <apache.httpclient.version>4.5.8</apache.httpclient.version>
         <javax.servlet.api.version>3.1.0</javax.servlet.api.version>
diff --git a/samples/java-tokenclient-usage/pom.xml b/samples/java-tokenclient-usage/pom.xml
index 42bf945c..d8c645b9 100755
--- a/samples/java-tokenclient-usage/pom.xml
+++ b/samples/java-tokenclient-usage/pom.xml
@@ -3,13 +3,13 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.sap.cloud.security.xssec.samples</groupId>
     <artifactId>java-tokenclient-usage</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
     <packaging>war</packaging>
 
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
-        <sap.cloud.security.version>2.7.3</sap.cloud.security.version>
+        <sap.cloud.security.version>2.7.4</sap.cloud.security.version>
         <apache.httpclient.version>4.5.8</apache.httpclient.version>
         <javax.servlet.api.version>3.0.1</javax.servlet.api.version>
     </properties>
diff --git a/samples/sap-java-buildpack-api-usage/pom.xml b/samples/sap-java-buildpack-api-usage/pom.xml
index 7f1b0ea0..c46631e5 100755
--- a/samples/sap-java-buildpack-api-usage/pom.xml
+++ b/samples/sap-java-buildpack-api-usage/pom.xml
@@ -3,13 +3,13 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>com.sap.cloud.security.xssec.samples</groupId>
 	<artifactId>sap-java-buildpack-api-usage</artifactId>
-	<version>2.7.3</version>
+	<version>2.7.4</version>
 	<packaging>war</packaging>
 
 	<properties>
 		<maven.compiler.source>1.8</maven.compiler.source>
 		<maven.compiler.target>1.8</maven.compiler.target>
-		<sap.cloud.security.version>2.7.3</sap.cloud.security.version>
+		<sap.cloud.security.version>2.7.4</sap.cloud.security.version>
 		<javax.servlet.api.version>3.0.1</javax.servlet.api.version>
 	</properties>
 
diff --git a/samples/spring-security-basic-auth/pom.xml b/samples/spring-security-basic-auth/pom.xml
index b2af8b7a..963641f0 100644
--- a/samples/spring-security-basic-auth/pom.xml
+++ b/samples/spring-security-basic-auth/pom.xml
@@ -11,14 +11,14 @@
 	</parent>
 
 	<artifactId>spring-security-basic-auth</artifactId>
-	<version>2.7.3</version>
+	<version>2.7.4</version>
 	<name>spring-security-basic-auth</name>
 
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<java.version>1.8</java.version>
-		<sap.cloud.security.version>2.7.3</sap.cloud.security.version>
+		<sap.cloud.security.version>2.7.4</sap.cloud.security.version>
 	</properties>
 
 	<dependencies>
diff --git a/samples/spring-security-xsuaa-usage/pom.xml b/samples/spring-security-xsuaa-usage/pom.xml
index 63fe1aeb..4c504ebf 100644
--- a/samples/spring-security-xsuaa-usage/pom.xml
+++ b/samples/spring-security-xsuaa-usage/pom.xml
@@ -14,7 +14,7 @@
 
 	<groupId>com.sap.cloud.security.samples</groupId>
 	<artifactId>spring-security-xsuaa-usage</artifactId>
-	<version>2.7.3</version>
+	<version>2.7.4</version>
 	<name>spring-security-xsuaa-usage</name>
 
 	<properties>
@@ -27,7 +27,7 @@
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<java.version>1.8</java.version>
-		<sap.cloud.security.version>2.7.3</sap.cloud.security.version>
+		<sap.cloud.security.version>2.7.4</sap.cloud.security.version>
 	</properties>
 
     <dependencies>
diff --git a/samples/spring-webflux-security-xsuaa-usage/pom.xml b/samples/spring-webflux-security-xsuaa-usage/pom.xml
index d669997e..3577d96d 100644
--- a/samples/spring-webflux-security-xsuaa-usage/pom.xml
+++ b/samples/spring-webflux-security-xsuaa-usage/pom.xml
@@ -12,12 +12,12 @@
 
     <groupId>com.sap.cloud.security.samples</groupId>
     <artifactId>spring-webflux-security-xsuaa-usage</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
     <name>spring-webflux-security-xsuaa-usage</name>
 
     <properties>
         <java.version>1.8</java.version>
-        <sap.cloud.security.version>2.7.3</sap.cloud.security.version>
+        <sap.cloud.security.version>2.7.4</sap.cloud.security.version>
     </properties>
 
     <dependencies>
diff --git a/spring-xsuaa-it/pom.xml b/spring-xsuaa-it/pom.xml
index 96037ea1..7bc49eec 100644
--- a/spring-xsuaa-it/pom.xml
+++ b/spring-xsuaa-it/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<artifactId>spring-xsuaa-it</artifactId>
diff --git a/spring-xsuaa-mock/README.md b/spring-xsuaa-mock/README.md
index ad4e8694..f6966162 100644
--- a/spring-xsuaa-mock/README.md
+++ b/spring-xsuaa-mock/README.md
@@ -21,7 +21,7 @@ The default implementation offers already valid *token_keys* for JWT tokens, tha
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>spring-xsuaa-mock</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
 </dependency>
 <dependency> <!-- new with version 1.5.0 - provided with org.springframework.boot:spring-boot-starter:jar -->
     <groupId>org.springframework.boot</groupId>
diff --git a/spring-xsuaa-mock/pom.xml b/spring-xsuaa-mock/pom.xml
index 0b8aa0de..4e9d528a 100644
--- a/spring-xsuaa-mock/pom.xml
+++ b/spring-xsuaa-mock/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<artifactId>spring-xsuaa-mock</artifactId>
diff --git a/spring-xsuaa-starter/pom.xml b/spring-xsuaa-starter/pom.xml
index 909dbab1..c920e462 100644
--- a/spring-xsuaa-starter/pom.xml
+++ b/spring-xsuaa-starter/pom.xml
@@ -14,7 +14,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<artifactId>xsuaa-spring-boot-starter</artifactId>
diff --git a/spring-xsuaa/README.md b/spring-xsuaa/README.md
index bb4330e1..47fe261e 100644
--- a/spring-xsuaa/README.md
+++ b/spring-xsuaa/README.md
@@ -25,7 +25,7 @@ These (spring) dependencies needs to be provided:
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>spring-xsuaa</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
 </dependency>
 <dependency> <!-- new with version 1.5.0 -->
     <groupId>org.apache.logging.log4j</groupId>
@@ -40,7 +40,7 @@ These (spring) dependencies needs to be provided:
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>xsuaa-spring-boot-starter</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
 </dependency>
 ```
 
diff --git a/spring-xsuaa/pom.xml b/spring-xsuaa/pom.xml
index 6186378d..7d7cc41f 100644
--- a/spring-xsuaa/pom.xml
+++ b/spring-xsuaa/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<artifactId>spring-xsuaa</artifactId>
diff --git a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java
index 591a3daa..5da2fe04 100644
--- a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java
+++ b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/authentication/XsuaaAudienceValidator.java
@@ -63,7 +63,6 @@ public class XsuaaAudienceValidator implements OAuth2TokenValidator<Jwt> {
 		// case 1 : token issued by own client (or master)
 		if (clientId.equals(tokenClientId)
 				|| (appId.contains("!b")
-						&& tokenClientId.contains("|")
 						&& tokenClientId.endsWith("|" + appId))) {
 			return true;
 		} else {
diff --git a/token-client/README.md b/token-client/README.md
index a5bf371a..8216c96f 100644
--- a/token-client/README.md
+++ b/token-client/README.md
@@ -23,7 +23,7 @@ The Resource owner password credentials (i.e., username and password) can be use
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
 </dependency>
 <dependency>
   <groupId>org.apache.httpcomponents</groupId>
@@ -62,7 +62,7 @@ By default, the `DefaultOAuth2TokenService` caches tokens internally. The Cache
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
 </dependency>
 ```
 
@@ -91,7 +91,7 @@ In context of a Spring Boot application you may like to leverage auto-configurat
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>xsuaa-spring-boot-starter</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
 </dependency>
 ```
 
diff --git a/token-client/pom.xml b/token-client/pom.xml
index 2bcc1234..413493bb 100644
--- a/token-client/pom.xml
+++ b/token-client/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<artifactId>token-client</artifactId>


Test patch:
diff --git a/java-security-test/README.md b/java-security-test/README.md
index 5ca39a9e..913f461e 100644
--- a/java-security-test/README.md
+++ b/java-security-test/README.md
@@ -22,7 +22,7 @@ It includes for example a `JwtGenerator` that generates JSON Web Tokens (JWT) th
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-security-test</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
     <scope>test</scope>
 </dependency>
 ```
diff --git a/java-security-test/pom.xml b/java-security-test/pom.xml
index 367377b8..2cfed338 100644
--- a/java-security-test/pom.xml
+++ b/java-security-test/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidatorTest.java b/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidatorTest.java
index 5e5752d4..dedaf933 100644
--- a/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidatorTest.java
+++ b/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidatorTest.java
@@ -26,6 +26,8 @@ public class JwtAudienceValidatorTest {
 		Mockito.when(token.getAudiences()).thenReturn(
 				Sets.newLinkedHashSet("client", "foreignclient", "sb-test4!t1.data"));
 		Mockito.when(token.getService()).thenReturn(Service.XSUAA);
+		Mockito.when(token.hasClaim(TokenClaims.XSUAA.CLIENT_ID)).thenReturn(true);
+		Mockito.when(token.getClaimAsString(TokenClaims.XSUAA.CLIENT_ID)).thenReturn("client");
 	}
 
 	@Test
@@ -59,7 +61,7 @@ public class JwtAudienceValidatorTest {
 	public void validate_clientIdMatchesTokenAudienceWithoutDot() {
 		// configures token audience
 		Mockito.when(token.getAudiences())
-				.thenReturn(Sets.newLinkedHashSet("client", "foreignclient", "sb-test4!t1.data.x"));
+				.thenReturn(Sets.newLinkedHashSet("client", "sb-test4!t1.data.x"));
 
 		// configures audience validator with client-id from VCAP_SERVICES
 		ValidationResult result = new JwtAudienceValidator("sb-test4!t1")
@@ -70,12 +72,11 @@ public class JwtAudienceValidatorTest {
 
 	@Test
 	public void validate_tokenClientIdMatchesTrustedClientId() {
-		// configures token audience
-		Mockito.when(token.hasClaim(TokenClaims.XSUAA.CLIENT_ID)).thenReturn(true);
-		Mockito.when(token.getClaimAsString(TokenClaims.XSUAA.CLIENT_ID)).thenReturn("sb-myclientid!t1");
+		Mockito.when(token.getAudiences()).thenReturn(Collections.emptySet());
+		Mockito.when(token.getClaimAsStringList(TokenClaims.XSUAA.SCOPES)).thenReturn(Collections.EMPTY_LIST);
 
 		// configures audience validator with client-id from VCAP_SERVICES
-		ValidationResult result = new JwtAudienceValidator("sb-myclientid!t1")
+		ValidationResult result = new JwtAudienceValidator("client")
 				.validate(token);
 
 		assertThat(result.isValid()).isTrue(); // should match
@@ -96,6 +97,30 @@ public class JwtAudienceValidatorTest {
 		assertThat(result.isValid()).isTrue(); // should match
 	}
 
+	@Test
+	public void validate_tokenClientIdMatchesTrustedBrokerClientId() {
+		Mockito.when(token.getAudiences()).thenReturn(Collections.emptySet());
+		Mockito.when(token.getClaimAsString(TokenClaims.XSUAA.CLIENT_ID)).thenReturn("sb-clone-app-id!b123|" + XSUAA_BROKER_XSAPPNAME);
+
+		// configures audience validator with client-id from VCAP_SERVICES
+		ValidationResult result = new JwtAudienceValidator(XSUAA_BROKER_XSAPPNAME)
+				.validate(token);
+
+		assertThat(result.isValid()).isTrue(); // should match
+	}
+
+	@Test
+	public void validate_tokenClientIdDoesNotMatchTrustedBrokerClientId() {
+		Mockito.when(token.getAudiences()).thenReturn(Collections.emptySet());
+		Mockito.when(token.getClaimAsString(TokenClaims.XSUAA.CLIENT_ID)).thenReturn("sb-clone-app-id!b123|-" + XSUAA_BROKER_XSAPPNAME);
+
+		// configures audience validator with client-id from VCAP_SERVICES
+		ValidationResult result = new JwtAudienceValidator(XSUAA_BROKER_XSAPPNAME)
+				.validate(token);
+
+		assertThat(result.isValid()).isFalse(); // should match
+	}
+
 	@Test
 	public void validationFails_brokerClientIdDoesNotMatchCloneAudience() {
 		// configures token audience
@@ -119,7 +144,7 @@ public class JwtAudienceValidatorTest {
 		assertThat(result.isErroneous()).isTrue();
 		assertThat(result.getErrorDescription())
 				.isEqualTo(
-						"Jwt token with audience [client, foreignclient, sb-test4!t1] is not issued for these clientIds: [any, anyother].");
+						"Jwt token with audience [client, foreignclient, sb-test4!t1.data] is not issued for these clientIds: [any, anyother].");
 	}
 
 	@Test
@@ -131,7 +156,7 @@ public class JwtAudienceValidatorTest {
 
 		assertThat(result.isErroneous()).isTrue();
 		assertThat(result.getErrorDescription())
-				.isEqualTo("Jwt token with audience [test] is not issued for these clientIds: [any].");
+				.isEqualTo("Jwt token with audience [., test.,  .test2] is not issued for these clientIds: [any].");
 	}
 
 	@Test
@@ -157,10 +182,10 @@ public class JwtAudienceValidatorTest {
 
 		// configures token audience
 		Mockito.when(token.getClaimAsStringList(TokenClaims.XSUAA.SCOPES)).thenReturn(scopes);
-		Mockito.when(token.getAudiences()).thenReturn(Sets.newHashSet());
+		Mockito.when(token.getAudiences()).thenReturn(Collections.EMPTY_SET);
 
 		// configures audience validator with client-id from VCAP_SERVICES
-		Set audiences = JwtAudienceValidator.getAllowedAudiences(token);
+		Set audiences = JwtAudienceValidator.extractAudiencesFromToken(token);
 
 		assertThat(audiences.size()).isEqualTo(3);
 		assertThat(audiences).containsExactlyInAnyOrder("test1!t1", "client", "xsappid");
diff --git a/spring-xsuaa-test/README.md b/spring-xsuaa-test/README.md
index e97150cc..3cf19eff 100644
--- a/spring-xsuaa-test/README.md
+++ b/spring-xsuaa-test/README.md
@@ -27,7 +27,7 @@ This includes for example a `JwtGenerator` that generates JSON Web Tokens (JWT)
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>spring-xsuaa-test</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.4</version>
     <scope>test</scope>
 </dependency>
 
diff --git a/spring-xsuaa-test/pom.xml b/spring-xsuaa-test/pom.xml
index 0ca3ca20..f9fc352c 100644
--- a/spring-xsuaa-test/pom.xml
+++ b/spring-xsuaa-test/pom.xml
@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.4</version>
 	</parent>
 
 	<artifactId>spring-xsuaa-test</artifactId>