ID token azp claim should not be required if aud is single value array

[agavrilov76]

Jetty version(s)
9,10,11

Java version/vendor (use: java -version)
N/A

OS type/version
N/A

Description
If audience of an ID token is an array containing a single value, the azp claim should not be required.
https://openid.net/specs/openid-connect-core-1_0.html#IDToken

How to reproduce?

A sample ID token:

eyJraWQiOiIxIiwiYWxnIjoiUlMyNTYifQ.eyJhY3IiOiIxIiwic3ViIjoiNTg5ODQyMjA1MzgyMzg0ODQ0OCIsImF1ZCI6WyJ0ZWxlbm9yZGlnaXRhbC1kb2Jwb3J0YWx0ZWxlbm9yaWQtd2ViIl0sImF1dGhfdGltZSI6MTYyODk0ODA2NywiYW1yIjpbIlNTTyJdLCJpc3MiOiJodHRwczpcL1wvc2lnbmluLnRlbGVub3JpZC1zdGFnaW5nLmNvbVwvb2F1dGgiLCJ0ZF9zbHMiOmZhbHNlLCJleHAiOjE2Mjg5NTI5MzgsImlhdCI6MTYyODk0OTAzOH0.hKSYTSxJj3vzqKrvjDGqu45hrYnrnKTRrh9BmoGUADO48OGkh0GC9H2Qm529qi8iQKO5PXK6qc1lnDpfX8xv0zmwYSPJHwRrtFEXjNLrEIsuTdtrK59Tf7t7LXdxduZI95YfWtEqbPQ7EO-ykDCQev44pE0ry4IvrsFRYUyf7HU

causes the following exception:

WARN  [2021-08-14 14:23:01,889] org.eclipse.jetty.security.openid.OpenIdLoginService: 
! org.eclipse.jetty.security.openid.OpenIdCredentials$AuthenticationException: A multi-audience ID token needs to contain an azp claim
! at org.eclipse.jetty.security.openid.OpenIdCredentials.validateAudience(OpenIdCredentials.java:150)
! at org.eclipse.jetty.security.openid.OpenIdCredentials.validateClaims(OpenIdCredentials.java:120)
! at org.eclipse.jetty.security.openid.OpenIdCredentials.redeemAuthCode(OpenIdCredentials.java:103)
! at org.eclipse.jetty.security.openid.OpenIdLoginService.login(OpenIdLoginService.java:87)
! at org.eclipse.jetty.security.authentication.LoginAuthenticator.login(LoginAuthenticator.java:67)
! at org.eclipse.jetty.security.openid.OpenIdAuthenticator.login(OpenIdAuthenticator.java:170)

[lachlan-roberts]

It looks like you're sending the aud as an array type with a single value, Jetty incorrectly assumes that it contains multiple audiences but there is only one.

I have put up PR to fix (see #6620).

[lachlan-roberts]

Fixed in both 9.4.x branch and 10/11.0.x branches.