[Spring Cloud Azure] Validate tfp/acr claim against configured user-flows in AadB2cResourceServerAutoConfiguration #51008

Library name and version

com.azure.spring:spring-cloud-azure-autoconfigure 7.4.0

Describe the bug

In AadB2cTrustedIssuerRepository (AadB2cTrustedIssuerRepository.java (lines 43–60)), addB2cUserFlowIssuers() registers policy-specific issuer URIs (<baseUri>/tfp/<tenantId>/<userFlow>/v2.0/) for each configured entry in spring.cloud.azure.active-directory.b2c.user-flows, while addB2cIssuer() also registers the tenant-level issuer URI (<baseUri>/<tenantId>/v2.0/).

When Azure AD B2C tokens use the <baseUri>/<tenantId>/v2.0/ issuer format, the user flow name is carried in the tfp (or acr) claim rather than in the iss path. However, AadB2cResourceServerAutoConfiguration.jwtDecoder (AadB2cResourceServerAutoConfiguration.java (lines 93–118)) only configures validators for aud, tid, iss, and timestamps, and does not check the tfp / acr claim against the configured user-flows when user-flows is populated.

Expected behavior

When spring.cloud.azure.active-directory.b2c.user-flows is configured, AadB2cResourceServerAutoConfiguration.jwtDecoder should validate that the token's tfp (or fallback acr) claim matches one of the configured user flow names in properties.getUserFlows().values(), consistent with how addB2cUserFlowIssuers() scopes /tfp/ issuer URLs to the configured user-flows.

Actual behavior

Tokens using the <baseUri>/<tenantId>/v2.0/ issuer format are only checked against AadJwtIssuerValidator, tid, aud, and timestamps, without checking tfp or acr against properties.getUserFlows().values().

Proposed Improvement

1. Add TFP ("tfp") and ACR ("acr") constants to AadJwtClaimNames.java.
2. In AadB2cResourceServerAutoConfiguration.jwtDecoder, when properties.getUserFlows() is non-empty, add a validator checking that tfp (or acr when tfp is absent) matches a configured user flow name (case-insensitively).
3. Add unit test coverage in AadB2cResourceServerAutoConfigurationTests.java.