Fikser audience for tokenveksling for TokenX (#1276)

navikt · Apr 19, 2023 · 492cd4e · 492cd4e
1 parent e66dc01
commit 492cd4e
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/token/impl/TokenXExchangeKlient.java b/felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/token/impl/TokenXExchangeKlient.java
@@ -59,13 +59,18 @@ private OidcTokenResponse hentToken(OpenIDToken token, String assertion, String
 
     private static HttpRequest.BodyPublisher ofFormData(OpenIDToken token, String assertion, String audience) {
         var formdata = "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&"
-            + "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&" + "client_assertion=" + assertion + "&"
-            + "subject_token_type=urn:ietf:params:oauth:token-type:jwt&" + "subject_token=" + token.token() + "&" + "audience=" + audience;
+            + "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&"
+            + "client_assertion=" + assertion + "&"
+            + "subject_token_type=urn:ietf:params:oauth:token-type:jwt&"
+            + "subject_token=" + token.token() + "&"
+            + "audience=" + audience;
         return HttpRequest.BodyPublishers.ofString(formdata, UTF_8);
     }
 
     private static String audience(String scope) {
-        //Støtter bare ett scope
-        return scope.replaceFirst("api://", "").replace("/.default", "");
+        return scope
+            .replaceFirst("api://", "")
+            .replace("/.default", "")
+            .replace(".", ":");
     }
 }