Add case insensitive check

auth0 · Jul 17, 2023 · ee5b61c · ee5b61c
1 parent bf4abd4
commit ee5b61c
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 1 deletion.
diff --git a/auth0/src/main/java/com/auth0/android/provider/IdTokenVerifier.kt b/auth0/src/main/java/com/auth0/android/provider/IdTokenVerifier.kt
@@ -73,7 +73,7 @@ internal class IdTokenVerifier {
                 if (TextUtils.isEmpty(orgNameClaim)) {
                     throw OrgNameClaimMissingException()
                 }
-                if (organizationInput != orgNameClaim) {
+                if (!organizationInput.equals(orgNameClaim, true)) {
                     throw OrgNameClaimMismatchException(organizationInput, orgNameClaim)
                 }
             }

diff --git a/auth0/src/test/java/com/auth0/android/provider/IdTokenVerifierTest.java b/auth0/src/test/java/com/auth0/android/provider/IdTokenVerifierTest.java
@@ -294,6 +294,25 @@ public void shouldFailWhenOrganizationNameClaimIsRequiredAndHasUnexpectedValue()
         assertEquals("com.auth0.android.provider.TokenValidationException: " + message, e.toString());
         assertEquals(message, e.getMessage());
     }
+    @Test
+    public void shouldNotFailWhenOrganizationNameClaimIsRequiredAndHasSameValue() throws Exception {
+        Map<String, Object> jwtBody = createJWTBody();
+        jwtBody.put("org_name", EXPECTED_ORGANIZATION_NAME);
+        String token = createTestJWT("none", jwtBody);
+        Jwt jwt = new Jwt(token);
+        options.setOrganization(EXPECTED_ORGANIZATION_NAME);
+        idTokenVerifier.verify(jwt, options, true);
+    }
+
+    @Test
+    public void shouldNotFailWhenOrganizationNameClaimIsRequiredAndHasSameValueInDifferentCase() throws Exception {
+        Map<String, Object> jwtBody = createJWTBody();
+        jwtBody.put("org_name", "__tESt_OrG_nAme__");
+        String token = createTestJWT("none", jwtBody);
+        Jwt jwt = new Jwt(token);
+        options.setOrganization(EXPECTED_ORGANIZATION_NAME);
+        idTokenVerifier.verify(jwt, options, true);
+    }
 
     @Test
     public void shouldNotFailWhenOrganizationIdClaimIsMissingButNotRequired() throws Exception {