Package net.shibboleth.oidc.security.impl

Class ExplicitKeySignedJWTTrustEngine

java.lang.Object
net.shibboleth.oidc.security.impl.BaseSignedJWTTrustEngine<Iterable<Credential>>
net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine
All Implemented Interfaces:
TrustedCredentialTrustEngine<com.nimbusds.jwt.SignedJWT>, TrustEngine<com.nimbusds.jwt.SignedJWT>
Direct Known Subclasses:
ClientInformationJWTTrustEngine
public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<Iterable<Credential>> implements TrustedCredentialTrustEngine<com.nimbusds.jwt.SignedJWT>
An implementation of SignatureTrustEngine which evaluates the validity and trustworthiness of JWT signatures.

Processing is first performed as described in BaseSignedJWTTrustEngine. If based on this processing, it is determined that the token does not present or does not contain a resolveable valid (and trusted) signing key, then all trusted credentials obtained by the trusted credential resolver will be used to attempt to validate the signature.

Since:
2.2.0

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • credentialResolver

      @Nonnull private final CredentialResolver credentialResolver
      Resolver used for resolving trusted credentials.

    • keyTrust

      private final ExplicitKeyTrustEvaluator keyTrust
      The external explicit key trust engine to use as a basis for trust in this implementation.

  • Constructor Details

    • ExplicitKeySignedJWTTrustEngine

      public ExplicitKeySignedJWTTrustEngine(@Nonnull @ParameterName(name="resolver") CredentialResolver resolver, @Nonnull @ParameterName(name="JOSEObjectResolver") JOSEObjectCredentialResolver joseObjectResolver)
      Constructor.
      Parameters:
      resolver - credential resolver used to resolve trusted credentials.
      joseObjectResolver - resolver which resolve credentials from the headers of a JOSEObject instance.

  • Method Details

    • getCredentialResolver

      @Nonnull public CredentialResolver getCredentialResolver()
      Specified by:
      getCredentialResolver in interface TrustedCredentialTrustEngine<com.nimbusds.jwt.SignedJWT>

    • doValidate

      protected boolean doValidate(@Nonnull com.nimbusds.jwt.SignedJWT signedJWT, @Nonnull CriteriaSet trustBasisCriteria) throws SecurityException
      Validate the signed JWT using the supplied trust criteria.
      Specified by:
      doValidate in class BaseSignedJWTTrustEngine<Iterable<Credential>>
      Parameters:
      signedJWT - the signed JWT to validate
      trustBasisCriteria - criteria used to describe and/or resolve the information which serves as the basis for trust evaluation
      Returns:
      true if signature is valid and trusted, false otherwise
      Throws:
      SecurityException - if there is a fatal error evaluating the signature

    • evaluateTrust

      protected boolean evaluateTrust(@Nonnull Credential untrustedCredential, @Nullable Iterable<Credential> trustedCredentials) throws SecurityException
      Evaluate the untrusted KeyInfo-derived credential with respect to the specified trusted information.
      Specified by:
      evaluateTrust in class BaseSignedJWTTrustEngine<Iterable<Credential>>
      Parameters:
      untrustedCredential - the untrusted credential being evaluated
      trustedCredentials - the information which serves as the basis for trust evaluation
      Returns:
      true if the trust can be established for the untrusted credential, otherwise false
      Throws:
      SecurityException - if an error occurs during trust processing