Bugfix/4.0.2 (#1939)

NiklasHerrmann21 · web-flow · commit ed3b9ef76f7e · 2026-04-02T14:25:23.000+02:00
* fix: Use getClientIdentity() for token exchange credentials

Simplified DefaultIdTokenExtension and DefaultXsuaaTokenExtension to use
OAuth2ServiceConfiguration.getClientIdentity() instead of manually checking
for certificate vs client secret. This ensures correct credential handling
for both X.509 certificate and client secret authentication.

Also added IAS certificate properties (certificate, key, credential-type,
certurl) to IdentityServicesPropertySourceFactory to properly map X.509
credentials for IAS service bindings.

Changes:
- DefaultIdTokenExtension: Use iasConfig.getClientIdentity()
- DefaultXsuaaTokenExtension: Use xsuaaConfig.getClientIdentity()
- IdentityServicesPropertySourceFactory: Add IAS certificate properties

* test: Update tests to use getClientIdentity() mocks

* chore: Release 4.0.2

* test: Remove unused credentials variables from tests

* fix: Use token issuer for multi-tenant IAS token exchange

In multi-tenant scenarios, the IAS token exchange must use the issuer
from the token (consumer IAS tenant) instead of the provider IAS URL
from the configuration. This ensures the exchange request goes to the
correct tenant where the user exists.

* chore: Release 4.0.3
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,10 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## 4.0.3
+
+- Fix multi-tenant IAS token exchange to use token issuer URL instead of provider IAS URL from configuration in `DefaultIdTokenExtension`
+
 ## 4.0.2
 
 - Fix token exchange credential handling to use `getClientIdentity()` instead of manually checking for certificate vs client secret
diff --git a/MIGRATION_4.0.md b/MIGRATION_4.0.md
@@ -58,7 +58,7 @@ If you use these classes, add the new dependency:
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 No code changes required - the classes remain in the same package.
@@ -88,7 +88,7 @@ No code changes required - the classes remain in the same package.
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-starter</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
@@ -146,7 +146,7 @@ Replace the standard starter with the Spring Boot 3 starter:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-3-starter</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
@@ -203,7 +203,7 @@ The `spring-xsuaa` module has been removed. Migrate to either:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-security-test</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
     <scope>test</scope>
 </dependency>
 ```
@@ -234,7 +234,7 @@ import com.sap.cloud.security.test.JwtGenerator;
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>spring-security-3</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
@@ -272,7 +272,7 @@ The `token-client` module now uses Java 11 HttpClient by default - no additional
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
@@ -326,7 +326,7 @@ If you use any of these classes, add the new dependency:
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
diff --git a/README.md b/README.md
@@ -120,7 +120,7 @@ If your application uses Spring Boot 3.x and you cannot immediately upgrade to S
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-3-starter</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
@@ -275,7 +275,7 @@ The SAP Cloud Security Services Integration is published to maven central: https
         <dependency>
             <groupId>com.sap.cloud.security</groupId>
             <artifactId>java-bom</artifactId>
-            <version>4.0.2</version>
+            <version>4.0.3</version>
             <scope>import</scope>
             <type>pom</type>
         </dependency>
diff --git a/bom/pom.xml b/bom/pom.xml
@@ -8,7 +8,7 @@
 
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-bom</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
     <packaging>pom</packaging>
     <name>java-bom</name>
 
diff --git a/env/pom.xml b/env/pom.xml
@@ -9,7 +9,7 @@
     <parent>
         <groupId>com.sap.cloud.security.xsuaa</groupId>
         <artifactId>parent</artifactId>
-        <version>4.0.2</version>
+        <version>4.0.3</version>
     </parent>
 
     <groupId>com.sap.cloud.security</groupId>
diff --git a/java-api/README.md b/java-api/README.md
@@ -5,6 +5,6 @@
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-api</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
diff --git a/java-api/pom.xml b/java-api/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security-test/README.md b/java-security-test/README.md
@@ -40,7 +40,7 @@ It is pre-configured with a security filter that only accepts valid tokens. Furt
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
    <artifactId>java-security-test</artifactId>
-      <version>4.0.2</version>
+      <version>4.0.3</version>
    <scope>test</scope>
 </dependency>
 ```
diff --git a/java-security-test/pom.xml b/java-security-test/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security/README.md b/java-security/README.md
@@ -69,7 +69,7 @@ Since it requires the Tomcat 10 runtime, it needs to be deployed using the [SAP
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-security</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 <dependency>
     <groupId>org.apache.httpcomponents</groupId>
diff --git a/java-security/pom.xml b/java-security/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/DefaultIdTokenExtension.java b/java-security/src/main/java/com/sap/cloud/security/token/DefaultIdTokenExtension.java
@@ -140,7 +140,7 @@ private boolean isTechnicalUser(Token token) {
   private OAuth2TokenResponse exchangeAccessToIDToken(Token accessToken)
       throws OAuth2ServiceException {
 
-    final URI tokenEndpoint = URI.create(iasConfig.getUrl().toString() + "/oauth2/token");
+    final URI tokenEndpoint = URI.create(accessToken.getIssuer() + "/oauth2/token");
 
     final Map<String, String> params = new HashMap<>();
     params.put("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
diff --git a/java-security/src/test/java/com/sap/cloud/security/token/DefaultIdTokenExtensionTest.java b/java-security/src/test/java/com/sap/cloud/security/token/DefaultIdTokenExtensionTest.java
@@ -57,6 +57,7 @@ public void setUp() throws IOException {
     when(idToken.getClientId()).thenReturn(clientId);
     when(accessToken.getClaimAsStringList("aud")).thenReturn(List.of(audience));
     when(accessToken.getClientId()).thenReturn(clientId);
+    when(accessToken.getIssuer()).thenReturn(tokenUri.toString()); // Mock issuer for multi-tenant support
     when(technicalUserToken.getClaimAsString("sub")).thenReturn(clientId);
     when(technicalUserToken.getClientId()).thenReturn(clientId);
     when(tokenService.retrieveAccessTokenViaJwtBearerTokenGrant(
diff --git a/pom.xml b/pom.xml
@@ -7,7 +7,7 @@
 
 	<groupId>com.sap.cloud.security.xsuaa</groupId>
 	<artifactId>parent</artifactId>
-	<version>4.0.2</version>
+	<version>4.0.3</version>
 	<packaging>pom</packaging>
 
 	<name>parent</name>
diff --git a/spring-security-3-starter/pom.xml b/spring-security-3-starter/pom.xml
@@ -16,7 +16,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/spring-security-3/README.md b/spring-security-3/README.md
@@ -23,7 +23,7 @@ Use the Spring Boot 3.x starter instead:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-3-starter</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
diff --git a/spring-security-3/pom.xml b/spring-security-3/pom.xml
@@ -9,14 +9,14 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
 	<artifactId>spring-security-3</artifactId>
 	<name>spring-security-3</name>
 	<packaging>jar</packaging>
-	<version>4.0.2</version>
+	<version>4.0.3</version>
 
 	<url>https://github.com/SAP/cloud-security-xsuaa-integration</url>
 	<description>Java Spring security library for Spring Boot 3</description>
diff --git a/spring-security-starter/pom.xml b/spring-security-starter/pom.xml
@@ -16,7 +16,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/spring-security/README.md b/spring-security/README.md
@@ -69,7 +69,7 @@ These (spring) dependencies need to be provided:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-starter</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
diff --git a/spring-security/pom.xml b/spring-security/pom.xml
@@ -9,14 +9,14 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
 	<artifactId>spring-security</artifactId>
 	<name>spring-security</name>
 	<packaging>jar</packaging>
-	<version>4.0.2</version>
+	<version>4.0.3</version>
 
 	<url>https://github.com/SAP/cloud-security-xsuaa-integration</url>
 	<description>Java Spring security library</description>
diff --git a/token-client-spring-3/README.md b/token-client-spring-3/README.md
@@ -25,7 +25,7 @@ This module is the Spring Boot 3.x compatible version of [token-client-spring](.
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring-3</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
diff --git a/token-client-spring-3/pom.xml b/token-client-spring-3/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<artifactId>token-client-spring-3</artifactId>
diff --git a/token-client-spring/README.md b/token-client-spring/README.md
@@ -27,7 +27,7 @@ Starting with version 4.0.0, Spring-specific implementations have been moved to
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
@@ -65,7 +65,7 @@ If you were using `XsuaaOAuth2TokenService`, `SpringOAuth2TokenKeyService`, or `
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
diff --git a/token-client-spring/pom.xml b/token-client-spring/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<artifactId>token-client-spring</artifactId>
diff --git a/token-client/README.md b/token-client/README.md
@@ -33,7 +33,7 @@ Additionally, it offers an API with the [XsuaaTokenFlows](./src/main/java/com/sa
    <dependency>
        <groupId>com.sap.cloud.security.xsuaa</groupId>
        <artifactId>token-client-spring</artifactId>
-       <version>4.0.2</version>
+       <version>4.0.3</version>
    </dependency>
    ```
 
@@ -72,15 +72,15 @@ In context of a Spring Boot application you can leverage autoconfiguration provi
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-starter</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 In context of Spring Applications you will need the following dependencies:
 ```xml
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 <!-- No additional HTTP client dependency needed - Java 11 HttpClient is used by default -->
 <!-- Apache HttpClient 4 is included transitively for backward compatibility (deprecated constructors) -->
@@ -181,7 +181,7 @@ See the [OAuth2ServiceConfiguration](#oauth2serviceconfiguration) section and [H
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client</artifactId>
-    <version>4.0.2</version>
+    <version>4.0.3</version>
 </dependency>
 ```
 
diff --git a/token-client/pom.xml b/token-client/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.2</version>
+		<version>4.0.3</version>
 	</parent>
 
 	<artifactId>token-client</artifactId>
