KEYCLOAK-1150

'iss' should be URL not just realm name

core/src/main/java/org/keycloak/KeycloakSecurityContext.java

@@ -50,7 +50,7 @@ public class KeycloakSecurityContext implements Serializable {
 
     public String getRealm() {
         // Assumption that issuer contains realm name
-        return token.getIssuer();
+        return token.getIssuer().substring(token.getIssuer().lastIndexOf('/') + 1);
     }
 
     // SERIALIZATION

core/src/main/java/org/keycloak/RSATokenVerifier.java

@@ -12,11 +12,11 @@ import java.security.PublicKey;
  * @version $Revision: 1 $
  */
 public class RSATokenVerifier {
-    public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realm) throws VerificationException {
-        return verifyToken(tokenString, realmKey, realm, true);
+    public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realmUrl) throws VerificationException {
+        return verifyToken(tokenString, realmKey, realmUrl, true);
     }
 
-    public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realm, boolean checkActive) throws VerificationException {
+    public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realmUrl, boolean checkActive) throws VerificationException {
         JWSInput input = null;
         try {
             input = new JWSInput(tokenString);
@@ -35,7 +35,7 @@ public class RSATokenVerifier {
         if (user == null) {
             throw new VerificationException("Token user was null.");
         }
-        if (!realm.equals(token.getIssuer())) {
+        if (!realmUrl.equals(token.getIssuer())) {
             throw new VerificationException("Token audience doesn't match domain.");
 
         }

core/src/test/java/org/keycloak/RSAVerifierTest.java

@@ -72,7 +72,7 @@ public class RSAVerifierTest {
 
         token = new AccessToken();
         token.subject("CN=Client")
-                .issuer("domain")
+                .issuer("http://localhost:8080/auth/realm")
                 .addAccess("service").addRole("admin");
     }
 
@@ -102,7 +102,7 @@ public class RSAVerifierTest {
     }
 
     private AccessToken verifySkeletonKeyToken(String encoded) throws VerificationException {
-        return RSATokenVerifier.verifyToken(encoded, idpPair.getPublic(), "domain");
+        return RSATokenVerifier.verifyToken(encoded, idpPair.getPublic(), "http://localhost:8080/auth/realm");
     }
 
    /*

core/src/test/java/org/keycloak/SkeletonKeyTokenTest.java

@@ -104,7 +104,7 @@ public class SkeletonKeyTokenTest {
     private AccessToken createSimpleToken() {
         AccessToken token = new AccessToken();
         token.id("111");
-        token.issuer("acme");
+        token.issuer("http://localhost:8080/auth/acme");
         token.addAccess("foo").addRole("admin");
         token.addAccess("bar").addRole("user");
         return token;