make sure that client presenting refresh token is the same client the refresh token was issued to

closes #735

openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ProviderTokenService.java

@@ -236,6 +236,13 @@ public class DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityServi
 
 		AuthenticationHolderEntity authHolder = refreshToken.getAuthenticationHolder();
 		
+		// make sure that the client requesting the token is the one who owns the refresh token
+		ClientDetailsEntity requestingClient = clientDetailsService.loadClientByClientId(authRequest.getClientId());
+		if (requestingClient.getClientId() != client.getClientId()) {
+			tokenRepository.removeRefreshToken(refreshToken);
+			throw new InvalidClientException("Client does not own the presented refresh token");
+		}
+		
 		//Make sure this client allows access token refreshing
 		if (!client.isAllowRefresh()) {
 			throw new InvalidClientException("Client does not allow refreshing access token!");