Summary:

The code changes in this pull request focus on enhancing the security of the Janssen Authentication Server (JAS) application, particularly in the areas of authorization challenge handling, DPoP (Demonstration of Proof-of-Possession) implementation, and overall token management.

The key security improvements include:

1. DPoP Support: The changes introduce support for the DPoP mechanism, which helps mitigate the risk of access token theft and replay attacks by binding the access token to a specific client's public key.
2. Authorization Challenge Handling: The code updates various components to handle the authorization challenge process, which is a security mechanism used to prevent authorization code injection attacks.
3. Robust Token Validation: The changes include extensive validation of various token-related parameters, such as grant types, refresh tokens, and PKCE values, to ensure the integrity and security of the token exchange process.
4. Audit Logging: The code updates the OAuth2 audit log to provide a detailed audit trail of successful token requests, which is important for monitoring and investigating any suspicious activities.

Overall, the changes in this pull request demonstrate a strong focus on improving the security posture of the Janssen Authentication Server application by implementing industry-standard security practices and mechanisms, such as DPoP and authorization challenge handling. These enhancements help to mitigate various security risks and strengthen the overall security of the application.

Files Changed:

1. AuthorizationChallengeSessionAttributes.java: This class was updated to include a new field called jkt (JWK SHA-256 Thumbprint), which is used to store the DPoP public key thumbprint to bind the access token.
2. AuthorizationChallenge.java: The changes in this file handle the authorization challenge process, including the extraction and validation of the DPoP header and the management of the authorization challenge session.
3. DpopService.java: This class was updated to include methods for validating the DPoP JWT, including the extraction and validation of the JWK thumbprint.
4. AuthorizationChallengeEndpoint.java: The changes in this file focus on handling the authorization challenge request, including the extraction and validation of the DPoP header and the authorization challenge session.
5. AuthzRequest.java: A new dpop field was added to the AuthzRequest class, likely to support the DPoP mechanism.
6. AuthorizationChallengeSessionService.java: This class was updated to handle the creation, persistence, and retrieval of the authorization challenge session.
7. AuthorizationChallengeValidator.java: The changes in this file enhance the validation of the DPoP token and the grant type used in the authorization flow.
8. AuthorizationChallengeService.java: The changes in this file focus on handling the authorization challenge process, including the validation of the DPoP and JKT parameters.
9. AuthorizationGrant.java: The changes in this file include the addition of the authorizationChallenge attribute to the TokenEntity.
10. AbstractAuthorizationGrant.java: A new isAuthorizationChallenge flag was introduced in this class.
11. AuthorizationGrantList.java: The changes in this file include the addition of the authorizationChallenge field to the AuthorizationGrant object.
12. TokenRestWebServiceValidator.java: The changes in this file focus on the validation of request parameters, including the redirect URI and PKCE parameters.
13. TokenAttributes.java: A new authorizationChallenge property was added to the TokenAttributes class.
14. TokenRestWebServiceImpl.java: The changes in this file focus on the handling of various grant types, including the validation of parameters and the implementation of token binding.
15. TokenRestWebServiceValidatorTest.java: This file includes tests for validating the various token-related parameters and conditions during the token exchange process.