Validate against multiple issuers

[cescoferraro]

Is there a way to validate against multiple issuers with the current api?

[lbalmaceda]

No, since the JWTVerifier#withIssuer only accepts a single string and the JWTVerifier#withArrayClaim will check that all the passed array contents are present in the token rather than only checking if the token's issuer is part of the passed array.
Could be added though.

[crizo23]

Other JWT libraries accept an array of issuers so this would be a very nice-to-have.

[jogee]

We are looking for something similar when switching to a custom domain with auth0, when you switch to a custom domain the issuer changes although the auth0 tenant stays the same. To handle this we temporarily have to accept multiple issuers.

The patch with having multiple verifiers seems to be the best solution to be able to transition properly.

[lbalmaceda]

This is already in our backlog. I'll discuss with the team on the coming days if we should raise the priority. 👍

[rocketraman]

I'd like to have this too. My use case is that we have one issuer prefix e.g. https://foo.com with multiple valid paths, such as https://foo.com/v1-issuer and https://foo.com/v2-issuer. Therefore, I need to be able to pass in a list of valid issuers.

You could make this even more generic by supporting a method like withIssuer(IssuerValidator) where IssuerValidator is a SAM interface for easy lamda implementation. That being said, more complex cases like that can be handled at the application level after parsing, so I would be fine with just the multiple issuer support.

[rocketraman]

That being said, more complex cases like that can be handled at the application level after parsing, so I would be fine with just the multiple issuer support.

Enabling this at the application level would be nice by supporting a generic validation method like this on Verification, where each call contributes an additional custom validation:

withCustomValidation(CustomJwtValidator) where CustomJwtValidator is:

interface CustomJwtValidator {
  validate(DecodedJWT jwt) throws JWTVerificationException;
}

[rocketraman]

FYI, the logic I describe above implemented in #290.

[jogee]

With the custom validator the issuer claim would still fail if multiple issuers aren't supported, these look like two separate concepts. Adding the possibility to add custom validations on application layer seems like a good idea though.

[rocketraman]

With the custom validator the issuer claim would still fail if multiple issuers aren't supported, these look like two separate concepts. Adding the possibility to add custom validations on application layer seems like a good idea though.

I agree, the custom validation logic is not a replacement for this issue -- I do believe it is still a valid thing to desire the ability to validate against multiple issuers. I simply reference it as a workaround that is also useful in other situations.

[coperator]

This issue is solved with #288, is it not?

[jogee]

Yes, it can be closed.