Add an extra subject_token verification to protect token extensions

[fhanik]

Summary

• TokenExchangeGranter.getTokenActor() now calls
  ExternalOAuthAuthenticationManager.verifySubjectToken() instead of the
  parse-only JwtHelper.decode(). The new method resolves the registered
  identity provider by the token's iss claim, verifies the JWT signature
  against that provider's published keys, and checks expiry — reusing logic
  already present in ExternalOAuthAuthenticationManager.
• OAuth2FilterConfig wires the existing externalOAuthAuthenticationManager
  bean into TokenExchangeGranter as a new constructor parameter.
• Two new MockMvc tests cover the granter-level check end-to-end:
  TokenExchangeDefaultConfigMockMvcTests confirms the default configuration
  rejects a tampered token at the filter layer (HTTP 401); the new
  TokenExchangeSubjectTokenSignatureBypassMockMvcTests confirms the granter
  independently rejects it (HTTP 400 invalid_grant) even when the filter
  layer is replaced by a custom bean that skips signature checking.

[Copilot]

Pull request overview

This PR hardens OAuth2 Token Exchange by ensuring TokenExchangeGranter independently verifies the subject_token JWT signature (and expiry) based on the issuer-mapped registered IdP, preventing signature-check bypasses when the filter-layer authentication manager is overridden.

Changes:

• Added ExternalOAuthAuthenticationManager.verifySubjectToken() to resolve IdP by iss, verify signature, and check expiry.
• Updated TokenExchangeGranter to call verifySubjectToken() (instead of parse-only decoding) and wired the needed bean via OAuth2FilterConfig.
• Added unit and MockMvc integration tests to prove tampered subject_tokens are rejected both in the default setup and when the filter layer skips signature validation.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/token/TokenExchangeSubjectTokenSignatureBypassMockMvcTests.java	New integration test proving granter-level verification rejects tampered tokens even if filter-layer verification is bypassed via bean override.
uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/token/TokenExchangeDefaultConfigMockMvcTests.java	Adds default-configuration integration coverage showing tampered subject_token is blocked at the filter layer (401).
server/src/test/java/org/cloudfoundry/identity/uaa/oauth/token/TokenExchangeGranterTests.java	Updates unit tests for new granter dependency and adds signature-verification failure cases.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java	Introduces verifySubjectToken() API to reuse existing issuer resolution + signature/expiry validation logic.
server/src/main/java/org/cloudfoundry/identity/uaa/oauth/token/TokenExchangeGranter.java	Replaces parse-only JWT decoding with signature+expiry verification for subject_token.
server/src/main/java/org/cloudfoundry/identity/uaa/oauth/provider/config/xml/OAuth2FilterConfig.java	Wires externalOAuthAuthenticationManager into TokenExchangeGranter via constructor injection.