==============================================================================
docs/output/03-audience-ignored.txt
A token minted for a DIFFERENT service, presented to the downstream service.
Default validators.
==============================================================================

# the token reporting-service was issued:
{
  "alg": "RS256",
  "kid": "<uuid>"
}
{
  "aud": "reporting-api",
  "exp": <epoch>,
  "iat": <epoch>,
  "iss": "http://127.0.0.1:9000",
  "jti": "<uuid>",
  "nbf": <epoch>,
  "scope": [
    "orders.read"
  ],
  "sub": "reporting-service"
}

$ curl -H 'Authorization: Bearer <reporting-service token>' 127.0.0.1:8082/orders
{
    "service": "downstream:8082",
    "strictValidation": false,
    "sub": "reporting-service",
    "aud": [
        "reporting-api"
    ],
    "iss": "http://127.0.0.1:9000",
    "scope": "[orders.read]",
    "client_id": null,
    "authorities": [
        "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
        "SCOPE_orders.read"
    ],
    "cnf": null,
    "orders": [
        {
            "total": "42.00",
            "id": 1
        }
    ]
}

# HTTP 200. The aud claim says reporting-api. The service is downstream-api.
# JwtValidators.createDefault() is a DelegatingOAuth2TokenValidator over three
# validators - JwtTypeValidator, JwtTimestampValidator and
# X509CertificateThumbprintValidator. Structure, expiry, and certificate binding.
# No issuer. No audience. Read back by reflection in ValidatorContractTests.