Package net.shibboleth.oidc.security.impl

Class JWTSignatureValidationUtil

java.lang.Object

net.shibboleth.oidc.security.impl.JWTSignatureValidationUtil

public final class JWTSignatureValidationUtil
extends Object

Generic utility class for helping JWT signature validation.

Field Summary

Fields

Modifier and Type	Field	Description
private static org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Modifier	Constructor	Description
private	JWTSignatureValidationUtil()	Private constructor.

Method Summary

Modifier and Type	Method	Description
private static com.nimbusds.jose.JWSVerifier	initializeVerifier(com.nimbusds.jose.Algorithm algorithm, Credential credential)	Initializes a JWSVerifier for the given algorithm, using the provided Credential.
static String	validateSignature(List<JWKCredential> credentials, com.nimbusds.jwt.SignedJWT signedJwt, String invalidJwtEventId)	Deprecated, for removal: This API element is subject to removal in a future version.
static String	validateSignature(SecurityParametersContext secParamCtx, com.nimbusds.jwt.SignedJWT signedJwt, String invalidJwtEventId)	Deprecated, for removal: This API element is subject to removal in a future version.
static String	validateSignatureEx(Collection<? extends Credential> credentials, com.nimbusds.jwt.SignedJWT signedJwt, String invalidJwtEventId)	Validates the signature of the given JWS against the given list of credentials.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

log

@Nonnull
private static org.slf4j.Logger log

Class logger.

Constructor Details

JWTSignatureValidationUtil

private JWTSignatureValidationUtil()

Private constructor.

Method Details

validateSignature

@Deprecated(since="1.2.0",
            forRemoval=true)
@Nullable
public static String validateSignature(@Nullable
 SecurityParametersContext secParamCtx,
 @Nonnull
 com.nimbusds.jwt.SignedJWT signedJwt,
 @Nullable
 String invalidJwtEventId)

Deprecated, for removal: This API element is subject to removal in a future version.

Validates the signature of the given JWT using the given security parameters context. If the validation fails for any reason, including insufficient prequisities in the context, an event identifier is returned. Successful validation produces a null result.

Overloads validateSignature(SecurityParametersContext, SignedJWT, String), but with a 'radically' different parameter.

Parameters:

secParamCtx - The SecurityParametersContext to use for signature validation.

signedJwt - The signed JWT to be validated.

invalidJwtEventId - The event identifier describing the invalid JWT.

Returns:

an event ID on failure, or null if validation succeeds.

validateSignature

@Deprecated(since="1.2.0",
            forRemoval=true)
public static String validateSignature(@Nonnull
 List<JWKCredential> credentials,
 @Nonnull
 com.nimbusds.jwt.SignedJWT signedJwt,
 @Nullable
 String invalidJwtEventId)

Deprecated, for removal: This API element is subject to removal in a future version.

Validates the signature of the given JWS against the given list of credentials. If the validation fails for any reason, including insufficient prequisities in the context, an event identifier is returned. Successful validation produces null result.

Parameters:

credentials - The list of JWKCredentials to use for signature validation.

signedJwt - The signed JWT to be validated.

invalidJwtEventId - The event identifier describing the invalid JWT.

Returns:

an event ID on failure, or null if validation succeeds.

validateSignatureEx

public static String validateSignatureEx(@Nonnull
 Collection<? extends Credential> credentials,
 @Nonnull
 com.nimbusds.jwt.SignedJWT signedJwt,
 @Nullable
 String invalidJwtEventId)

Validates the signature of the given JWS against the given list of credentials. If the validation fails for any reason, including insufficient prequisities in the context, an event identifier is returned. Successful validation produces null result.

Parameters:

credentials - The list of Credentials to use for signature validation.

signedJwt - The signed JWT to be validated.

invalidJwtEventId - The event identifier describing the invalid JWT.

Returns:

an event ID on failure, or null if validation succeeds.

initializeVerifier

private static com.nimbusds.jose.JWSVerifier initializeVerifier(com.nimbusds.jose.Algorithm algorithm,
 Credential credential)
                                                         throws com.nimbusds.jose.JOSEException

Initializes a JWSVerifier for the given algorithm, using the provided Credential.

Parameters:

algorithm - The algorithm used for deciding the verifier.

credential - The credential to be used for the verifier.

Returns:

A corresponding verifier, or null if no supported found.

Throws:

com.nimbusds.jose.JOSEException - If the credential doesn't meet the verifier requirements.