Validate aud and resource claims in returned ID-JAG JWT

The XAA IdP exchange (RFC 8693) returned an ID-JAG JWT without
validating its aud or resource claims against the values requested in
the exchange. If the IdP minted an ID-JAG for a different audience or
resource, ToolHive forwarded it to the target AS unchanged — a token-
misbinding / confused-deputy risk.

Add validateIDJAGClaims to check the aud claim (REQUIRED per draft
§3.1, membership check per RFC 7519 §4.1.3) and the resource claim
(OPTIONAL per §3.1, validated when one was requested) inside the
returned ID-JAG JWT. A non-JWT assertion that fails to parse is now
rejected rather than forwarded. The typ header check remains logged-
only by design (the draft §3.1 MUST is on the issuer; ToolHive is the
holder/presenter).

Closes #5696

Author: jhrozek

pkg/vmcp/auth/strategies/xaa.go

@@ -224,7 +224,10 @@ func (*XAAStrategy) authenticateWithClientCredentials(
 
 // performIDPExchange runs the RFC 8693 token exchange at the IdP to obtain an
 // ID-JAG. It verifies the response's issued_token_type matches the ID-JAG URN
-// per draft-ietf-oauth-identity-assertion-authz-grant §4.3.3.
+// (draft §4.3.3) and that token_type is N_A (draft §5.2), logs a mismatch on
+// the JWT typ header, rejects an empty or unparseable assertion, and validates
+// the aud/resource binding claims against what was requested (confused-deputy
+// defence; see validateIDJAGClaims).
 func (*XAAStrategy) performIDPExchange(
 	ctx context.Context, idToken string, config *xaaParsedConfig,
 ) (string, error) {
@@ -277,19 +280,107 @@ func (*XAAStrategy) performIDPExchange(
 	const idJAGJWTType = "oauth-id-jag+jwt"
 	parser := jwt.NewParser()
 	parsed, _, parseErr := parser.ParseUnverified(assertion, jwt.MapClaims{})
-	if parseErr == nil {
-		if typ, _ := parsed.Header["typ"].(string); !strings.EqualFold(typ, idJAGJWTType) {
-			slog.Debug("xaa: ID-JAG JWT typ header mismatch",
-				"got", typ, "want", idJAGJWTType,
-			)
-		}
-	} else {
-		slog.Debug("xaa: could not parse ID-JAG JWT header for typ check", "error", parseErr)
+	if parseErr != nil {
+		// A non-parseable assertion cannot carry valid aud/resource claims and
+		// therefore cannot be a valid ID-JAG. Fail fast rather than forwarding
+		// an unvalidated assertion to the target AS.
+		return "", fmt.Errorf("IdP exchange: ID-JAG assertion is not a valid JWT: %w", parseErr)
+	}
+	if typ, _ := parsed.Header["typ"].(string); !strings.EqualFold(typ, idJAGJWTType) {
+		slog.Debug("xaa: ID-JAG JWT typ header mismatch",
+			"got", typ, "want", idJAGJWTType,
+		)
+	}
+	// The assertion cannot fail: ParseUnverified was called with a literal
+	// jwt.MapClaims{}, which it decodes into in place. The !ok branch is
+	// defensive.
+	claims, ok := parsed.Claims.(jwt.MapClaims)
+	if !ok {
+		return "", fmt.Errorf("IdP exchange: ID-JAG claims are not MapClaims")
+	}
+	if err := validateIDJAGClaims(claims, config.targetAudience, config.targetResource); err != nil {
+		return "", err
 	}
 
 	return assertion, nil
 }
 
+// validateIDJAGClaims checks the aud and resource claims of the returned ID-JAG
+// JWT against the values requested in the IdP exchange (draft §3.1, §5).
+//
+// Per draft §4.4.1, aud MUST be a single-value issuer identifier: either a JSON
+// string, or a JSON array containing exactly one element. A multi-element aud
+// array is malformed and is rejected (see audMatches). resource is checked
+// only when one was requested (the resource parameter is OPTIONAL per draft
+// §4.3); when one was requested, ToolHive requires the returned ID-JAG to echo
+// it — a deliberate strict-binding policy, stricter than the draft, which
+// leaves resource OPTIONAL in the response even when requested.
+//
+// This is defence-in-depth against token misbinding: if the IdP mints an ID-JAG
+// for a different audience/resource, the target AS should reject it — but
+// ToolHive fails fast rather than forwarding a mismatched assertion.
+//
+// Per RFC 7519 §4.1.3, the aud claim may be a string or an array of strings;
+// golang-jwt/v5 decodes a JSON array as []interface{} whose elements are
+// strings. resource legitimately allows an array of URIs per draft §3.1, so a
+// membership check (claimContainsString) is used there; aud does not permit
+// multiple values, so a dedicated single-value check (audMatches) is used
+// instead.
+func validateIDJAGClaims(claims jwt.MapClaims, wantAudience, wantResource string) error {
+	// aud is REQUIRED and single-valued per draft §4.4.1.
+	if !audMatches(claims, wantAudience) {
+		return fmt.Errorf("IdP exchange: ID-JAG aud claim %v does not match requested audience %q", claims["aud"], wantAudience)
+	}
+
+	// Deliberately stricter than the draft: resource is OPTIONAL in the ID-JAG
+	// even when requested, but ToolHive rejects an ID-JAG that omits it once
+	// the operator has configured a resource to bind to.
+	if wantResource != "" && !claimContainsString(claims, "resource", wantResource) {
+		return fmt.Errorf(
+			"IdP exchange: ID-JAG resource claim %v does not contain requested resource %q",
+			claims["resource"], wantResource,
+		)
+	}
+
+	return nil
+}
+
+// audMatches reports whether the aud claim is a single-value issuer identifier
+// equal to want, per draft §4.4.1: either a JSON string, or a JSON array
+// containing exactly one element. Any other shape — missing, multi-element
+// array, empty array, wrong type, or a non-string element — is rejected.
+func audMatches(claims jwt.MapClaims, want string) bool {
+	switch v := claims["aud"].(type) {
+	case string:
+		return v == want
+	case []interface{}:
+		if len(v) != 1 {
+			return false
+		}
+		s, ok := v[0].(string)
+		return ok && s == want
+	default:
+		return false
+	}
+}
+
+// claimContainsString reports whether the named claim contains want. Per RFC
+// 7519 the claim may be a single string or an array; golang-jwt/v5 decodes JSON
+// arrays as []interface{} whose elements are strings.
+func claimContainsString(claims jwt.MapClaims, key, want string) bool {
+	switch v := claims[key].(type) {
+	case string:
+		return v == want
+	case []interface{}:
+		for _, e := range v {
+			if s, ok := e.(string); ok && s == want {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // performTargetGrant runs the RFC 7523 JWT Bearer grant at the target AS using
 // the ID-JAG assertion returned by IdP exchange.
 func (*XAAStrategy) performTargetGrant(