feat(oauth): Support multiple values in the “aud” claim for JWT client assertions (#185)

Co-authored-by: Alexandre Dutra <adutra@apache.org>

Author: sji-buttercup

docs/configuration.md

@@ -403,7 +403,7 @@ The subject of the client assertion JWT. Optional. The default is the client ID.
 
 ### `rest.auth.oauth2.client-assertion.jwt.audience`
 
-The audience of the client assertion JWT. Optional. The default is the token endpoint.
+The audience of the client assertion JWT. Optional. The default is the token endpoint. Can be a single audience or a comma-separated list of audiences.
 
 ### `rest.auth.oauth2.client-assertion.jwt.token-lifespan`
 

oauth2/core/src/main/java/com/dremio/iceberg/authmgr/oauth2/config/ClientAssertionConfig.java

@@ -66,9 +66,12 @@ public interface ClientAssertionConfig {
   @WithName(SUBJECT)
   Optional<Subject> getSubject();
 
-  /** The audience of the client assertion JWT. Optional. The default is the token endpoint. */
+  /**
+   * The audience of the client assertion JWT. Optional. The default is the token endpoint. Can be a
+   * single audience or a comma-separated list of audiences.
+   */
   @WithName(AUDIENCE)
-  Optional<Audience> getAudience();
+  Optional<List<Audience>> getAudience();
 
   /** The expiration time of the client assertion JWT. Optional. The default is 5 minutes. */
   @WithName(TOKEN_LIFESPAN)
@@ -166,10 +169,15 @@ default void validate() {
   }
 
   default Map<String, String> asMap() {
-    Map<String, String> properties = new HashMap<>();
+    Map<String, String> properties = new HashMap<String, String>();
     getIssuer().ifPresent(i -> properties.put(PREFIX + '.' + ISSUER, i.getValue()));
     getSubject().ifPresent(s -> properties.put(PREFIX + '.' + SUBJECT, s.getValue()));
-    getAudience().ifPresent(a -> properties.put(PREFIX + '.' + AUDIENCE, a.getValue()));
+    getAudience()
+        .ifPresent(
+            a ->
+                properties.put(
+                    PREFIX + '.' + AUDIENCE,
+                    a.stream().map(Audience::getValue).collect(Collectors.joining(","))));
     properties.put(PREFIX + '.' + TOKEN_LIFESPAN, getTokenLifespan().toString());
     getAlgorithm().ifPresent(a -> properties.put(PREFIX + '.' + ALGORITHM, a.getName()));
     getKeyId().ifPresent(k -> properties.put(PREFIX + '.' + KEY_ID, k));

oauth2/core/src/main/java/com/dremio/iceberg/authmgr/oauth2/flow/AbstractFlow.java

@@ -231,18 +231,19 @@ private JWTAssertionDetails createJwtAssertionDetails(URI tokenEndpoint) {
         getConfig().getClientAssertionConfig().getSubject().isPresent()
             ? getConfig().getClientAssertionConfig().getSubject().get()
             : new Subject(getConfig().getBasicConfig().getClientId().orElseThrow().getValue());
-    Audience audience =
-        getConfig().getClientAssertionConfig().getAudience().isPresent()
-            ? getConfig().getClientAssertionConfig().getAudience().get()
-            : new Audience(tokenEndpoint);
+    List<Audience> audiences =
+        getConfig()
+            .getClientAssertionConfig()
+            .getAudience()
+            .orElseGet(() -> List.of(new Audience(tokenEndpoint)));
     Instant issuedAt = getRuntime().getClock().instant();
     Instant expiration = issuedAt.plus(getConfig().getClientAssertionConfig().getTokenLifespan());
     @SuppressWarnings({"rawtypes", "unchecked"})
     Map<String, Object> extraClaims = (Map) getConfig().getClientAssertionConfig().getExtraClaims();
     return new JWTAssertionDetails(
         issuer,
         subject,
-        List.of(audience),
+        audiences,
         Date.from(expiration),
         Date.from(issuedAt),
         Date.from(issuedAt),

oauth2/core/src/test/java/com/dremio/iceberg/authmgr/oauth2/config/ClientAssertionConfigTest.java

@@ -20,6 +20,7 @@
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 
 import com.dremio.iceberg.authmgr.oauth2.config.validator.ConfigValidator;
+import com.nimbusds.oauth2.sdk.id.Audience;
 import io.smallrye.config.SmallRyeConfig;
 import io.smallrye.config.SmallRyeConfigBuilder;
 import io.smallrye.config.common.MapBackedConfigSource;
@@ -149,4 +150,38 @@ void testKeyIdPresent() {
         smallRyeConfig.getConfigMapping(ClientAssertionConfig.class, PREFIX);
     assertThat(config.getKeyId()).hasValue("my-key-123");
   }
+
+  @Test
+  void testAudienceSingleValue() {
+    Map<String, String> properties =
+        Map.of(PREFIX + '.' + ClientAssertionConfig.AUDIENCE, "https://example.com");
+    SmallRyeConfig smallRyeConfig =
+        new SmallRyeConfigBuilder()
+            .withMapping(ClientAssertionConfig.class, PREFIX)
+            .withSources(new MapBackedConfigSource("catalog-properties", properties, 1000) {})
+            .build();
+    ClientAssertionConfig config =
+        smallRyeConfig.getConfigMapping(ClientAssertionConfig.class, PREFIX);
+    assertThat(config.getAudience()).contains(List.of(new Audience("https://example.com")));
+  }
+
+  @Test
+  void testAudienceMultipleValues() {
+    Map<String, String> properties =
+        Map.of(
+            PREFIX + '.' + ClientAssertionConfig.AUDIENCE,
+            "https://auth1.example.com,https://auth2.example.com");
+    SmallRyeConfig smallRyeConfig =
+        new SmallRyeConfigBuilder()
+            .withMapping(ClientAssertionConfig.class, PREFIX)
+            .withSources(new MapBackedConfigSource("catalog-properties", properties, 1000) {})
+            .build();
+    ClientAssertionConfig config =
+        smallRyeConfig.getConfigMapping(ClientAssertionConfig.class, PREFIX);
+    assertThat(config.getAudience())
+        .contains(
+            List.of(
+                new Audience("https://auth1.example.com"),
+                new Audience("https://auth2.example.com")));
+  }
 }