Api protection JWt token introspection enhancement

[pujavs]

Requirement:

1. config-api will maintain a restricted list of issuer’s in properties file.
2. config-api will support bearer access token - JWT and reference(simple)
   3) JWT Flow: -
   3.1) Parse Jwt token
   3.2) Validate Token - Issuer should be present in the restricted list
   3.3) Validate Issuer
   3.4) Retrieve Auth Server JSON Web Keys - jwks_uri"
   3.5) Verify the signature used to sign the access token
   3.6) Verify the scopes
   If any of the above steps fails will throw 401 - Unauthorized.
3. Reference(simple) Token Flow: -
   4.1) If Issuer is present in any of above cases then it be validated against the restricted list and if issuer is not among this list than config-api reject’s call and will throw 401 - Unauthorized.
   4.2) Issuer if present in restricted list than introspection url fetched using discovery endpoint and token validated against it.
   4.3) If issuer is not present then the token will be validated against the underlying jans-auth-server.

Acceptance Criteria.

1. Successful authorization and access to valid JWT access token
2. Successful authorization and access to valid Reference access token

[pujavs]

Exception cases tested;

1. Exception Case#1: Jwt Issuer is Invalid
2. Exception Case#2: ID Token is expired
3. Exception Case#3: Jwt Signature is Invalid

Evidence:
Uploading Issues#17-Jwt_N_Reference_Access_Token.xlsx…

[pujavs]

Successful Testing

Tested code with successful Jwks validation of external IDP (access token generated other than underlying auth server)
Evidence:
Issues#17-Jwt_N_Reference_Access_Token_Success.xlsx

[pujavs]

RSA and EC token testing results

Issues#17-Jwt_N_Reference_Access_Token_Success.xlsx

[pujavs]

Code deployed and working as expected on gasmyr.gluu.org
Code reviewed and merged into master => https://github.com/JanssenProject/jans-config-api/pull/18