apereo / cas / 29519930660-1

90%

push

github

Fix OIDC private_key_jwt support

About the client authentication method in the OIDC protocol, the spec: https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication is clear:

```
private_key_jwt
Clients that have registered a public key sign a JWT using that key. The Client authenticates in accordance with [JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://openid.net/specs/openid-connect-core-1_0.html#OAuth.JWT) [OAuth.JWT] and [Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants](https://openid.net/specs/openid-connect-core-1_0.html#OAuth.Assertions) [OAuth.Assertions]. The JWT MUST contain the following REQUIRED Claim Values and MAY contain the following OPTIONAL Claim Values:
iss
REQUIRED. Issuer. This MUST contain the client_id of the OAuth Client.
sub
REQUIRED. Subject. This MUST contain the client_id of the OAuth Client.
aud
REQUIRED. Audience. The aud (audience) Claim. Value that identifies the Authorization Server as an intended audience. The Authorization Server MUST verify that it is an intended audience for the token. The Audience SHOULD be the URL of the Authorization Server's Token Endpoint.
jti
REQUIRED. JWT ID. A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties; any such negotiation is beyond the scope of this specification.
exp
REQUIRED. Expiration time on or after which the JWT MUST NOT be accepted for processing.
iat
OPTIONAL. Time at which the JWT was issued.
```

**Issuer = client_id and Audience = token endpoint.**

This PR fixes the problem. Unit tests have been updated accordingly.

6583 of 9331 branches covered (70.55%)

Branch coverage included in aggregate %.

43169 of 45685 relevant lines covered (94.49%)

71.68 hits per line