Part of #5194.
Extracts a SubjectTokenValidator interface (renaming the concrete self-issued implementation to SelfIssuedTokenValidator) and adds a MultiIssuerTokenValidator that validates tokens issued by trusted external OIDC issuers — the trust-model groundwork for the "federated" token exchange path described in #5194.
- JWKS caching with TTL, OIDC discovery fallback when no JWKS URL is configured
- SSRF-safe JWKS URL validation (HTTPS-only, rejects private/loopback addresses)
- Fails loudly if a trusted issuer is configured without an
ExpectedAudience
- Drains response bodies on non-200 discovery/JWKS fetch errors
Branch: token-delegation-3-multi-issuer-validator
Part of #5194.
Extracts a
SubjectTokenValidatorinterface (renaming the concrete self-issued implementation toSelfIssuedTokenValidator) and adds aMultiIssuerTokenValidatorthat validates tokens issued by trusted external OIDC issuers — the trust-model groundwork for the "federated" token exchange path described in #5194.ExpectedAudienceBranch:
token-delegation-3-multi-issuer-validator