JWT validation pattern with `jku` and `kid` claims

Hi @nenaraab,

In SAP Cloud SDK, we’re integrating your library to handle XSUAA authentication topics. Currently, we’re fixing JWT validation that fails because of this change: tenant specific JWT signing keys

In regard to this, I have a couple of questions to ensure our implementation is secure and compliant:

• How do you ensure jku is from a whitelisted domain? Should we ensure it on Cloud SDK side?
• As I understood from the sources you consider jku trusted after ensuring that issue is trusted by checking iss?
• Does XSUAA always provide jku and kid to fetch the public key for token validation? Or it can also be only jku?
• If a mocked or testing server is used to issue JWT how can we provide a URL of this issuer to make validation work for running tests locally or other use cases requiring to override XSUAA as s token issuer?

Thank you in advance for your help! I hope this makes sense. cc @MatKuhr @newtork

Best, Artem

[nenaraab]

cool. Perfect and good migration idea 😃

[MatKuhr]

Thanks, that would actually be great.

We currently use the library like this:

final Token token = new XsuaaToken(encodedJwt);
final OAuth2ServiceConfiguration xsuaaConfiguration = Environments.getCurrent().getXsuaaConfiguration();

if( xsuaaConfiguration == null ) {
    throw new AuthTokenAccessException("Unable to fetch XSUAA configuration from VCAP services.");
}
final CombiningValidator<Token> validator = JwtValidatorBuilder.getInstance(xsuaaConfiguration).build();

final ValidationResult result = validator.validate(token);
if( result.isValid() ) {
    return JWT.decode(encodedJwt);
}
throw new AuthTokenAccessException("The token is invalid: " + result.getErrorDescription());

In case this validation fails we fall back to our “old” implementation and try again. That way our own mocking still works and nothing can break for the consumer.

So far one of our consumers confirmed that this works. Next steps would probably be leveraging the mocking capabilites of the XSUAA lib to better test this and also to deprecate our custom implementation.