Add the service-to-service module

service-to-service/docs/output/03-audience-ignored.txt

@@ -0,0 +1,53 @@
+==============================================================================
+docs/output/03-audience-ignored.txt
+A token minted for a DIFFERENT service, presented to the downstream service.
+Default validators.
+==============================================================================
+
+# the token reporting-service was issued:
+{
+  "alg": "RS256",
+  "kid": "<uuid>"
+}
+{
+  "aud": "reporting-api",
+  "exp": <epoch>,
+  "iat": <epoch>,
+  "iss": "http://127.0.0.1:9000",
+  "jti": "<uuid>",
+  "nbf": <epoch>,
+  "scope": [
+    "orders.read"
+  ],
+  "sub": "reporting-service"
+}
+
+$ curl -H 'Authorization: Bearer <reporting-service token>' 127.0.0.1:8082/orders
+{
+    "service": "downstream:8082",
+    "strictValidation": false,
+    "sub": "reporting-service",
+    "aud": [
+        "reporting-api"
+    ],
+    "iss": "http://127.0.0.1:9000",
+    "scope": "[orders.read]",
+    "client_id": null,
+    "authorities": [
+        "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
+        "SCOPE_orders.read"
+    ],
+    "cnf": null,
+    "orders": [
+        {
+            "total": "42.00",
+            "id": 1
+        }
+    ]
+}
+
+# HTTP 200. The aud claim says reporting-api. The service is downstream-api.
+# JwtValidators.createDefault() is a DelegatingOAuth2TokenValidator over three
+# validators - JwtTypeValidator, JwtTimestampValidator and
+# X509CertificateThumbprintValidator. Structure, expiry, and certificate binding.
+# No issuer. No audience. Read back by reflection in ValidatorContractTests.