mitreid-connect/OpenID-Connect-Java-Spring-Server — pull request #620 by celkins (2014-06-13 22:34:05+00:00)
Title: Validate HMAC-signed ID tokens in the client filter

I am trying to integrate the client filter into an application using [Auth0](https://auth0.com/) as an OP. After coding around some minor spec compliance issues (which I have reported to them), I'm now working on ID token validation. The only signing algorithm they seem to support is HS256.

Adding support for HMAC validation was fairly straight-forward now with the presence of `SymmetricCacheService`. However, that class has somewhat-surprising behavior: it assumes that client secrets (as represented in `ClientDetailsEntity`) are not Base64 encoded. It seems like `ClientDetailsEntity` needs some way to indicate that the secret is already encoded.