Token Refactor Step 5: Improve Audience Handling

[paullatzelsperger]

Feature Request

Currently, the aud claim of tokens is always derived from the remote message's counterPartyAddress property, which contains the DSP callback address, which
is obviously incorrect.

What the aud claim is supposed to contain will depend on the type of IdentityService: IATP may use a DID, OAuth2 may use a URL, etc. To accommodate that, the RemoteMessage will
get a counterPartyId field which is assigned by the IdentityService implementation upon message egress and can be obtained from a prior ContractNegotiation or TransferProcess.

On message ingress, the IdentityService validates the audience. This is already in place and does not need to change.

Which Areas Would Be Affected?

dsp protocol layers

Why Is the Feature Desired?

Use the correct audience depending on the IdentityService impl

Solution Proposal

• Add RemoteMessage#getCounterPartyId()
• Adjust TokenParameters:

  - private String audience;
  + private String counterPartyId;
  + private String counterPartyAddress;

[github-actions]

This issue is stale because it has been open for 14 days with no activity.