The jwt validation is failing on the audience validation. Error "No aud claim in token or audience not specified"

May 4, 2023
Knowledge

Title

URL Name

the-jwt-validation-is-failing-on-the-audience-validation-error-no-aud-claim-in-token-or-audience-not-specified

Article Number

000232202

Environment

Product: OpenEdge Version:12.x OS: All supported platforms Other: PASOE OAuth2

Question/Problem Description

The jwt validation is failing on the audience validation. Error "No aud claim in token or audience not specified"

With oauth2.resSvc.tokenServices=oauth2 or jwt
The audience validation is included in the commonValidators and jwtjwkValidators Spring configurations (enableOAuth2ResourceServer.xml)

oauth2.resSvc.audience=XXXXXXX is configured to match the "aud" claim in the jwt token.

If the token contains the "aud" claim all works fine.

The "aud" claim is an optional claim and not all providers supply this claim.
Azure AD provide the claim in both access and ID tokens and the value is set as the Client ID.
AWS Cognito supply the "aud" claim in the ID token but not the access token. Cognito provides the client_id claim in the access token but not in the ID token.

When using oauth2.resSvc.tokenServices=oauth2, the oauth2.resSvc.clientIdField can be defined and the value set in oauth2.resSvc.clientId. This allows configuration of what token claim to use client ID validation and what value.

But there does not seem to be a configuration for the audience validation.

As a workaround I modified the enableOAuth2ResourceServer.xml file and removed the audience validation. But this is not ideal and I would prefer not to have to customize the Spring xml files.

Steps to Reproduce

Clarifying Information

With oauth2.resSvc.tokenServices=oauth2 or jwt
The audience validation is included in the commonValidators and jwtjwkValidators Spring configurations (enableOAuth2ResourceServer.xml)

oauth2.resSvc.audience=XXXXXXX is configured to match the "aud" claim in the jwt token.

If the token contains the "aud" claim all works fine.

The "aud" claim is an optional claim and not all providers supply this claim.
Azure AD provide the claim in both access and ID tokens and the value is set as the Client ID.
AWS Cognito supply the "aud" claim in the ID token but not the access token. Cognito provides the client_id claim in the access token but not in the ID token.

When using oauth2.resSvc.tokenServices=oauth2, the oauth2.resSvc.clientIdField can be defined and the value set in oauth2.resSvc.clientId. This allows configuration of what token claim to use client ID validation and what value.

But there does not seem to be a configuration for the audience validation.

Error Message

An error occurred while attempting to decode the Jwt: Invalid token does not contain resource id (xxxxxxxxxxx) c.p.a.s.s.jwt.OEAudienceValidator - No aud claim in token or audience not specified: "xxxxxxxxxxx"

Defect Number

OCTA-52101

Enhancement Number

Cause

Resolution

Fixed version(s): OpenEdge 12.7

Workaround

As a workaround modify the enableOAuth2ResourceServer.xml file and remove the audience validation.

Notes

Keyword Phrase

Last Modified Date

10/23/2023 12:05 PM

The jwt validation is failing on the audience validation. Error "No aud claim in token or audience not specified"

Files(0)

Was this article helpful?

Was this article helpful?

The jwt validation is failing on the audience validation. Error "No aud claim in token or audience not specified"

Information

Related Articles