Fix org name verification logic

auth0 · Jul 18, 2023 · 6972a5f · 6972a5f
1 parent 3761a13
commit 6972a5f
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 2 deletions.
diff --git a/auth0/src/main/java/com/auth0/android/provider/IdTokenVerifier.kt b/auth0/src/main/java/com/auth0/android/provider/IdTokenVerifier.kt
@@ -73,7 +73,7 @@ internal class IdTokenVerifier {
                 if (TextUtils.isEmpty(orgNameClaim)) {
                     throw OrgNameClaimMissingException()
                 }
-                if (!organizationInput.equals(orgNameClaim, true)) {
+                if (organizationInput.lowercase() != orgNameClaim) {
                     throw OrgNameClaimMismatchException(organizationInput, orgNameClaim)
                 }
             }

diff --git a/auth0/src/test/java/com/auth0/android/provider/IdTokenVerifierTest.java b/auth0/src/test/java/com/auth0/android/provider/IdTokenVerifierTest.java
@@ -305,7 +305,7 @@ public void shouldNotFailWhenOrganizationNameClaimIsRequiredAndHasSameValue() th
     }
 
     @Test
-    public void shouldNotFailWhenOrganizationNameClaimIsRequiredAndHasSameValueInDifferentCase() throws Exception {
+    public void shouldFailWhenInputClaimHasDifferentCaseThanOrgNameReceived() throws Exception {
         Map<String, Object> jwtBody = createJWTBody();
         jwtBody.put("org_name", "__tESt_OrG_nAme__");
         String token = createTestJWT("none", jwtBody);
@@ -314,6 +314,16 @@ public void shouldNotFailWhenOrganizationNameClaimIsRequiredAndHasSameValueInDif
         idTokenVerifier.verify(jwt, options, true);
     }
 
+    @Test
+    public void shouldNotFailWhenOrgNameInputHasDifferentCaseThanClaimReceived() throws Exception {
+        Map<String, Object> jwtBody = createJWTBody();
+        jwtBody.put("org_name", EXPECTED_ORGANIZATION_NAME);
+        String token = createTestJWT("none", jwtBody);
+        Jwt jwt = new Jwt(token);
+        options.setOrganization("__tESt_OrG_nAme__");
+        idTokenVerifier.verify(jwt, options, true);
+    }
+
     @Test
     public void shouldNotFailWhenOrganizationIdClaimIsMissingButNotRequired() throws Exception {
         Map<String, Object> jwtBody = createJWTBody("org_id");