improve domain validation handling (#1945)

NiklasHerrmann21 · web-flow · commit acb1d15476ca · 2026-04-23T11:04:01.000+02:00
improve domain validation handling
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,10 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## 4.0.4
+
+- Improve domain validation handling in `JwtValidatorBuilder` for IAS tokens
+
 ## 4.0.3
 
 - Fix multi-tenant IAS token exchange to use token issuer URL instead of provider IAS URL from configuration in `DefaultIdTokenExtension`
diff --git a/README.md b/README.md
@@ -120,7 +120,7 @@ If your application uses Spring Boot 3.x and you cannot immediately upgrade to S
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-3-starter</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 ```
 
@@ -275,7 +275,7 @@ The SAP Cloud Security Services Integration is published to maven central: https
         <dependency>
             <groupId>com.sap.cloud.security</groupId>
             <artifactId>java-bom</artifactId>
-            <version>4.0.3</version>
+            <version>4.0.4</version>
             <scope>import</scope>
             <type>pom</type>
         </dependency>
diff --git a/bom/pom.xml b/bom/pom.xml
@@ -8,7 +8,7 @@
 
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-bom</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
     <packaging>pom</packaging>
     <name>java-bom</name>
 
diff --git a/env/pom.xml b/env/pom.xml
@@ -9,7 +9,7 @@
     <parent>
         <groupId>com.sap.cloud.security.xsuaa</groupId>
         <artifactId>parent</artifactId>
-        <version>4.0.3</version>
+        <version>4.0.4</version>
     </parent>
 
     <groupId>com.sap.cloud.security</groupId>
diff --git a/java-api/README.md b/java-api/README.md
@@ -5,6 +5,6 @@
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-api</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 ```
diff --git a/java-api/pom.xml b/java-api/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security-test/README.md b/java-security-test/README.md
@@ -40,7 +40,7 @@ It is pre-configured with a security filter that only accepts valid tokens. Furt
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
    <artifactId>java-security-test</artifactId>
-      <version>4.0.3</version>
+      <version>4.0.4</version>
    <scope>test</scope>
 </dependency>
 ```
diff --git a/java-security-test/pom.xml b/java-security-test/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security/README.md b/java-security/README.md
@@ -69,7 +69,7 @@ Since it requires the Tomcat 10 runtime, it needs to be deployed using the [SAP
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-security</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 <dependency>
     <groupId>org.apache.httpcomponents</groupId>
diff --git a/java-security/pom.xml b/java-security/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtIssuerValidator.java b/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtIssuerValidator.java
@@ -24,7 +24,6 @@
 
 import static com.sap.cloud.security.token.validation.ValidationResults.createInvalid;
 import static com.sap.cloud.security.token.validation.ValidationResults.createValid;
-import static com.sap.cloud.security.xsuaa.Assertions.assertNotEmpty;
 
 /**
  * Validates that the jwt token is issued by a trust worthy identity provider.
@@ -85,7 +84,6 @@ private static void tryLoadingLocalhostIssuerValidator() {
 	 * 		the list of domains of the identity provider {@link OAuth2ServiceConfiguration#getDomains()}
 	 */
 	JwtIssuerValidator(List<String> domains) {
-		assertNotEmpty(domains, "JwtIssuerValidator requires a domain(s).");
 		this.domains = domains;
 	}
 
@@ -105,6 +103,12 @@ public ValidationResult validate(Token token) {
 					"Issuer validation can not be performed because token does not contain an issuer claim.");
 		}
 
+		if (domains == null || domains.isEmpty()) {
+			return createInvalid(
+					"Issuer validation failed: No trusted domains configured. Rejecting token with issuer {}.",
+					issuer);
+		}
+
 		// Check for invisible characters (tabs, newlines, etc.) or URL-encoded characters
 		if (containsInvisibleOrEncodedCharacters(issuer)) {
 			return createInvalid(
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtValidatorBuilder.java b/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtValidatorBuilder.java
@@ -226,9 +226,7 @@ private List<Validator<Token>> createDefaultValidators() {
 			signatureValidator = new XsuaaJwtSignatureValidator(configuration, tokenKeyServiceWithCache,
 					getOidcConfigurationServiceWithCache());
 		} else if (configuration.getService() == IAS) {
-			if (configuration.getDomains() != null && !configuration.getDomains().isEmpty()) {
-				defaultValidators.add(new JwtIssuerValidator(configuration.getDomains()));
-			}
+			defaultValidators.add(new JwtIssuerValidator(configuration.getDomains()));
 
 			signatureValidator = new SapIdJwtSignatureValidator(configuration, tokenKeyServiceWithCache,
 					getOidcConfigurationServiceWithCache());
diff --git a/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtIssuerValidatorTest.java b/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtIssuerValidatorTest.java
@@ -40,12 +40,25 @@ void setup() {
 	}
 
 	@Test
-	void constructor_throwsOnNullValues() {
-		assertThatThrownBy(() -> new JwtIssuerValidator(null)).isInstanceOf(IllegalArgumentException.class)
-				.hasMessageContainingAll("JwtIssuerValidator", "domain(s)");
+	void validationFails_whenDomainsListIsEmpty() {
+		cut = new JwtIssuerValidator(new ArrayList<>());
+		when(token.getIssuer()).thenReturn("https://accounts400.ondemand.com");
 
-		assertThatThrownBy(() -> new JwtIssuerValidator(new ArrayList<>())).isInstanceOf(IllegalArgumentException.class)
-				.hasMessageContainingAll("JwtIssuerValidator", "domain(s)");
+		ValidationResult validationResult = cut.validate(token);
+		assertThat(validationResult.isValid()).isFalse();
+		assertThat(validationResult.isErroneous()).isTrue();
+		assertThat(validationResult.getErrorDescription()).contains("No trusted domains configured");
+	}
+
+	@Test
+	void validationFails_whenDomainsListIsNull() {
+		cut = new JwtIssuerValidator(null);
+		when(token.getIssuer()).thenReturn("https://accounts400.ondemand.com");
+
+		ValidationResult validationResult = cut.validate(token);
+		assertThat(validationResult.isValid()).isFalse();
+		assertThat(validationResult.isErroneous()).isTrue();
+		assertThat(validationResult.getErrorDescription()).contains("No trusted domains configured");
 	}
 
 	@ParameterizedTest
diff --git a/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtValidatorBuilderTest.java b/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtValidatorBuilderTest.java
@@ -203,4 +203,32 @@ public void configureOtherServiceInstances() {
 		fail("No JwtAudienceValidator found that contains all clientIds!"); // should never be called
 	}
 
-}
+	@Test
+	public void buildIas_withoutDomains_issuerValidatorIsIncluded() {
+		OAuth2ServiceConfigurationBuilder iasConfigBuilder = OAuth2ServiceConfigurationBuilder.forService(IAS)
+				.withClientId("T0123456");
+
+		List<Validator<Token>> validators = JwtValidatorBuilder.getInstance(iasConfigBuilder.build())
+				.build()
+				.getValidators();
+
+		assertThat(validators)
+				.hasSize(4)
+				.hasAtLeastOneElementOfType(JwtIssuerValidator.class);
+	}
+
+	@Test
+	public void buildIas_withEmptyDomains_issuerValidatorIsIncluded() {
+		OAuth2ServiceConfigurationBuilder iasConfigBuilder = OAuth2ServiceConfigurationBuilder.forService(IAS)
+				.withDomains()
+				.withClientId("T0123456");
+
+		List<Validator<Token>> validators = JwtValidatorBuilder.getInstance(iasConfigBuilder.build())
+				.build()
+				.getValidators();
+
+		assertThat(validators)
+				.hasSize(4)
+				.hasAtLeastOneElementOfType(JwtIssuerValidator.class);
+	}
+}
diff --git a/pom.xml b/pom.xml
@@ -7,7 +7,7 @@
 
 	<groupId>com.sap.cloud.security.xsuaa</groupId>
 	<artifactId>parent</artifactId>
-	<version>4.0.3</version>
+	<version>4.0.4</version>
 	<packaging>pom</packaging>
 
 	<name>parent</name>
diff --git a/samples/spring-security-basic-auth/pom.xml b/samples/spring-security-basic-auth/pom.xml
@@ -8,7 +8,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 		<relativePath/>
 	</parent>
 
diff --git a/samples/spring-security-hybrid-usage/pom.xml b/samples/spring-security-hybrid-usage/pom.xml
@@ -10,7 +10,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 		<relativePath/>
 	</parent>
 
diff --git a/spring-security-3-starter/pom.xml b/spring-security-3-starter/pom.xml
@@ -16,7 +16,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/spring-security-3/README.md b/spring-security-3/README.md
@@ -23,7 +23,7 @@ Use the Spring Boot 3.x starter instead:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-3-starter</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 ```
 
diff --git a/spring-security-3/pom.xml b/spring-security-3/pom.xml
@@ -9,14 +9,14 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
 	<artifactId>spring-security-3</artifactId>
 	<name>spring-security-3</name>
 	<packaging>jar</packaging>
-	<version>4.0.3</version>
+	<version>4.0.4</version>
 
 	<url>https://github.com/SAP/cloud-security-xsuaa-integration</url>
 	<description>Java Spring security library for Spring Boot 3</description>
diff --git a/spring-security-starter/pom.xml b/spring-security-starter/pom.xml
@@ -16,7 +16,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/spring-security/README.md b/spring-security/README.md
@@ -69,7 +69,7 @@ These (spring) dependencies need to be provided:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-starter</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 ```
 
diff --git a/spring-security/pom.xml b/spring-security/pom.xml
@@ -9,14 +9,14 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
 	<artifactId>spring-security</artifactId>
 	<name>spring-security</name>
 	<packaging>jar</packaging>
-	<version>4.0.3</version>
+	<version>4.0.4</version>
 
 	<url>https://github.com/SAP/cloud-security-xsuaa-integration</url>
 	<description>Java Spring security library</description>
diff --git a/token-client-spring-3/README.md b/token-client-spring-3/README.md
@@ -25,7 +25,7 @@ This module is the Spring Boot 3.x compatible version of [token-client-spring](.
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring-3</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 ```
 
diff --git a/token-client-spring-3/pom.xml b/token-client-spring-3/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<artifactId>token-client-spring-3</artifactId>
diff --git a/token-client-spring/README.md b/token-client-spring/README.md
@@ -27,7 +27,7 @@ Starting with version 4.0.0, Spring-specific implementations have been moved to
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 ```
 
@@ -65,7 +65,7 @@ If you were using `XsuaaOAuth2TokenService`, `SpringOAuth2TokenKeyService`, or `
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 ```
 
diff --git a/token-client-spring/pom.xml b/token-client-spring/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<artifactId>token-client-spring</artifactId>
diff --git a/token-client/README.md b/token-client/README.md
@@ -33,7 +33,7 @@ Additionally, it offers an API with the [XsuaaTokenFlows](./src/main/java/com/sa
    <dependency>
        <groupId>com.sap.cloud.security.xsuaa</groupId>
        <artifactId>token-client-spring</artifactId>
-       <version>4.0.3</version>
+       <version>4.0.4</version>
    </dependency>
    ```
 
@@ -72,15 +72,15 @@ In context of a Spring Boot application you can leverage autoconfiguration provi
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-starter</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 ```
 In context of Spring Applications you will need the following dependencies:
 ```xml
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 <!-- No additional HTTP client dependency needed - Java 11 HttpClient is used by default -->
 <!-- Apache HttpClient 4 is included transitively for backward compatibility (deprecated constructors) -->
@@ -181,7 +181,7 @@ See the [OAuth2ServiceConfiguration](#oauth2serviceconfiguration) section and [H
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client</artifactId>
-    <version>4.0.3</version>
+    <version>4.0.4</version>
 </dependency>
 ```
 
diff --git a/token-client/pom.xml b/token-client/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.3</version>
+		<version>4.0.4</version>
 	</parent>
 
 	<artifactId>token-client</artifactId>
