Security: Harden B2C resource server token validation defaults

[rujche]

Description

Summary

This PR fixes security gaps in B2C resource-server JWT validation by mirroring the hardening introduced for AAD in #49033.

The previous B2C default configuration could accept tokens from unintended issuers because:

• tenant-id values such as common were not rejected,
• tid claim validation was missing,
• audience validation used a containsAll predicate that allowed unsafe cases,
• B2C trusted issuers inherited default AAD issuer entries.

What changed

1. Enforced tenant-id validation in B2C resource server

Updated AadB2cResourceServerAutoConfiguration to reject null/empty/reserved tenant IDs (common, organizations, consumers) and normalize tenant ID for comparison.

2. Added tid claim validator

Added JwtClaimValidator<String>(AadJwtClaimNames.TID, tenantId::equals) to bind tokens to the configured tenant.

3. Hardened aud claim predicate

Replaced validAudiences::containsAll with a strict predicate requiring:

• non-null audience claim,
• non-empty audience list,
• at least one audience matching configured valid audiences.

4. Removed unintended AAD issuer inheritance from B2C trusted issuer repository

Refactored AadTrustedIssuerRepository with an overload that can skip default AAD issuer seeding.
AadB2cTrustedIssuerRepository now calls the new constructor with includeAadIssuers=false, so B2C trusts only B2C issuers it explicitly adds.

Tests

Added/updated tests in AadB2cResourceServerAutoConfigurationTests to verify:

• invalid tenant IDs are rejected at startup,
• B2C trusted issuers do not contain AAD-line issuers.

Executed tests:

• mvn -pl spring-cloud-azure-autoconfigure -Dtest=AadB2cResourceServerAutoConfigurationTests test
• mvn -pl spring-cloud-azure-autoconfigure test

Result:

• BUILD SUCCESS
• full artifact run: Tests run: 1090, Failures: 0, Errors: 0, Skipped: 7

Impact

This change prevents cross-issuer acceptance paths in the B2C resource-server default configuration and aligns B2C token validation posture with recent AAD hardening.

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

[Copilot]

Pull request overview

This PR hardens Azure AD B2C resource-server JWT validation defaults in spring-cloud-azure-autoconfigure, aligning B2C validation behavior with the earlier AAD security hardening (e.g., explicit tenant binding, stricter aud validation, and issuer trust scoping).

Changes:

• Enforced B2C tenant-id validation (rejecting common/organizations/consumers and empty values) and normalized tenant-id for comparisons.
• Added a tid claim validator and replaced permissive aud validation (containsAll) with a strict “any configured audience matches” predicate.
• Prevented B2C trusted issuer repositories from inheriting default AAD issuer entries, and added/updated tests for the new behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

File	Description
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aadb2c/configuration/AadB2cResourceServerAutoConfiguration.java	Adds tenant-id validation/normalization, tid claim validation, and hardens aud claim validation for B2C JWT decoding.
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aad/security/jwt/AadTrustedIssuerRepository.java	Introduces an overload/constructor path to optionally skip default AAD issuer seeding (enabling B2C to avoid inheriting AAD issuers).
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aadb2c/security/jwt/AadB2cTrustedIssuerRepository.java	Uses the new issuer-repo constructor to exclude default AAD issuers and normalizes tenant-id passed to the base repository.
sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/aadb2c/configuration/AadB2cResourceServerAutoConfigurationTests.java	Adds assertions that B2C trusted issuers don’t include AAD issuers and verifies startup failure for invalid/empty tenant-id values.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[rujche]

/azp run java - spring - tests

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).