FND-1056 · SSA · Sandbox
SSA validation ignores org_jwks_endpoint
MediumOpen
Detected vs required
Detected configuration
org_jwks_endpoint claim unused
Required target
org_jwks_endpoint honoured for software JWKS
Impact
Sandbox SSA validation may diverge from Production behaviour.
Remediation guidance
Honour org_jwks_endpoint claim.
Remediation workflow: OPEN · Owner J. Carter · Due 2026-10-31
Evidence
2 artefacts linked to this finding or its control on the affected system
- EVD-2005Validating SSA — PASSSSA validation12 Sept, 14:35Approved
- EVD-2024Expired SSA rejected — PASSSSA validation11 Sept, 09:48Approved
Context
- System
- TPP Registration Service
- Environment
- Sandbox
- Control
- SSA-001 — SSA signature validation confirmed
- Category
- SSA
- Owner
- Unassigned
- Detected
- 13 Sept, 06:12
- Evidence ref
- SsaValidator.java · Line 76
- Cutover blocker
- No
Linked tests
TST-006Validating SSAPASS
TST-025Expired SSA rejectedPASS