Fix OAuth2TokenIntrospection issuer validation and add unit tests

[ramesh-nair-dev]

Summary

This PR updates the OAuth2TokenIntrospection class to correctly handle the 'issuer' (iss) claim. The changes ensure that the issuer can be either a valid URI or a plain string without throwing exceptions during token introspection validation.

Changes

• Updated OAuth2TokenIntrospection.Builder to accept non-URI issuer strings.
• Enhanced validateIssuer method to allow plain string issuers while still supporting valid URIs.
• Added unit tests to cover:
  • Non-URI issuer strings
  • Valid URI issuer strings
• Ensured existing claim validations (active, scope, exp, iat, nbf, aud) remain intact.

Benefits

• Prevents unnecessary exceptions when using non-URI issuer strings.
• Improves robustness and flexibility of OAuth2 token introspection.
• Increases test coverage for issuer-related functionality.

[MatthiasDrewsCS]

Is there really a benefit from first trying to parse a URI, and if this fails, still continue successfully? IMHO it would be enough to just check if the string is blank or not. Am I missing something?

[ramesh-nair-dev]

Thanks for the feedback You’re right — if we allow non-URI strings (like client IDs), then attempting to parse as a URI may not add much value.

My initial thought behind keeping the URI parsing was to still preserve compatibility with tokens where iss is a proper URI, and not reject them unintentionally. But since the validation already ensures the string isn’t blank, simplifying to just a non-blank check would be sufficient and cleaner.

I can update the implementation to only validate that iss is not blank. Would you prefer that direction?

[MatthiasDrewsCS]

Yes I would prefer simplicity. Compatibility is still preserved with such a simpler approach

[ramesh-nair-dev]

I will make the changes

[ramesh-nair-dev]

Hey matt can you please review changes

[MatthiasDrewsCS]

I like that. It would be even better to also slightly adjust the error message to something like "iss must not be empty"

[ramesh-nair-dev]

I like that. It would be even better to also slightly adjust the error message to something like "iss must not be empty"

I have made the changes please review it

[ramesh-nair-dev]

Thanks @MatthiasDrewsCS for the review and approval
Could a maintainer please approve the workflows and merge if everything looks good?

[jgrandja]

@ramesh-nair-dev See comment

[jgrandja]

Closing as per comment