[pavel-jares-bcm]

Description

This PR adds validation of a required audience in OIDC token.

API Mediation Layer supports optional validation of the aud (audience) claim in OIDC tokens. Use this setting to require that tokens identify the intended recipient.

Add aud to your existing OIDC configuration in zowe.yaml (available for components apiml, gateway and zaas):

  components: 
    gateway: 
      apiml: 
        security: 
          oidc: 
            enabled: true 
            aud: "api://zowe" 

Replace api://zowe with the audience your identity provider includes in tokens intended for API Mediation Layer.

When configured:

• A string aud claim must exactly match the configured value.
• An array aud claim must contain the configured value.
• Matching is case-sensitive. Tokens with a missing or mismatched audience are rejected.
• Audience validation applies to both local JWKS validation and external UserInfo validation, including fallback to UserInfo. A successful UserInfo response does not bypass the audience check.

For this example, both "aud": "api://zowe" and "aud": ["other-api", "api://zowe"] satisfy the audience requirement.

Audience validation is disabled by default. Omit aud or set it to "" to leave it disabled. Other token-validation requirements still apply.

Linked to # (issue)
Part of the # (epic)

ZOWESERVER_ZOWE_API-LAYER_V3-X_X-001

Type of change

Please delete options that are not relevant.

• feat: New feature (non-breaking change which adds functionality)

Checklist:

• My code follows the style guidelines of this project
• PR title conforms to commit message guideline ## Commit Message Structure Guideline
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• The java tests in the area I was working on leverage @nested annotations
• Any dependent changes have been merged and published in downstream modules

For more details about how should the code look like read the Contributing guideline

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
83.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud