fix(jans-auth-server): Duplicate iss and aud on introspection as jwt #3366
Closed
Description
Describe the bug
Duplicate iss
and aud
on introspection as jwt
oxauth counterpart: GluuFederation/oxAuth#1748
If you do an introspection on a token during a authorization code flow and include the "response_as_jwt" body value as true, the jwt is returned with a duplicate iss and aud.
Example JWT:
eyJraWQiOiI5N2M0MDU1ZS00YjEwLTQ3YTMtOTA0NS1jYTYxN2YxNTFiZTFfc2lnX3JzMjU2IiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOlsiYzcyYTcyNTktY2Q1NS00ZGMxLWJmYzAtY2Y1NmIzY2M3NzJmIiwiYzcyYTcyNTktY2Q1NS00ZGMxLWJmYzAtY2Y1NmIzY2M3NzJmIl0sInN1YiI6IjBzMXJydHFCYmZNV2lTeVV4ZlUzSFB6MzZwSEZxS2NFNnlxSFJRemp3bkUiLCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiYWNyX3ZhbHVlcyI6InBhc3Nwb3J0X3NvY2lhbCIsImlzcyI6WyJodHRwczovL3AyLmdsdXUub3JnIiwiaHR0cHM6Ly9wMi5nbHV1Lm9yZyJdLCJhY3RpdmUiOnRydWUsInRva2VuX3R5cGUiOiJiZWFyZXIiLCJleHAiOjE2Njk3OTc4NzAsImlhdCI6MTY2OTc5NzU3MCwiY2xpZW50X2lkIjoiYzcyYTcyNTktY2Q1NS00ZGMxLWJmYzAtY2Y1NmIzY2M3NzJmIiwidXNlcm5hbWUiOiJkaG9uaSJ9.WHpFAhid6Ga_iUfrN8Wp42Vh_s9t6DMmJ0yqtvVGJURZTZxZEfdKDFZXmLEHI_zN6vLlrFrC1BdWUzdGjGZjBz3nC-GaQNmm1-YnkgNqziBl2qI1OT8O1gwsSJIsCCQJUFg0YthlAVazo-rI7WuZFUeEl7hrKrqHfEQDxrb-FLa886pbbsgRg-j7HWyndTht9M6dM_JU1yWJ41BPJwD1mGfubeuuCZYcFJFr2icWimpaRVpHwRojSTx8gHVWHdk3tFHZLdXZQQg5-rfxD072TN7LKc3b5xmZvBaGZwks-FQYVfaU6wFj1QpbBtGREbtgzuP16MuvCyeYvDOkTfuFNw
Steps To Reproduce
Steps to reproduce the behavior:
- Implement the Code Auth Flow
- Get access token from Code Auth flow
- Try to instrospect access token with
response_as_jwt=true
curl -k --location --request POST 'https://xxx.xxx.xxx/oxauth/restv1/introspection' \