Package net.shibboleth.oidc.security.credential

Interface ClientSecretCredential

All Known Implementing Classes:

DefaultClientSecretCredential

public interface ClientSecretCredential

Credential wrapping a client_secret. Contains methods to convert the client_secret into suitable keys used for signing and encryption.

Note, despite its name, this is not an opensaml Credential type.

Since:

2.2.0

Method Summary

Modifier and Type	Method	Description
String	getSecret()	Get the client_secret as a UTF-8 encoded String.
byte[]	getSecretAsBytes()	Get the client_secret as UTF-8 bytes.
JWKCredential	toEncryptionCredential(JWEAlgorithm alg, EncryptionMethod enc)	Create a symmetric encryption key derived from the client_secret and compatible with the key management mode and encryption algorithm specified.
JWKCredential	toSigningCredential()	Create a MAC singing key from the client_secret.

Method Details

getSecret

@Nonnull
@NotEmpty
String getSecret()

Get the client_secret as a UTF-8 encoded String.

Returns:

The client_secret.

getSecretAsBytes

@Nonnull
byte[] getSecretAsBytes()

Get the client_secret as UTF-8 bytes.

Returns:

the client_secret in bytes

toSigningCredential

@Nonnull
JWKCredential toSigningCredential()

Create a MAC singing key from the client_secret. The MAC key used is the octets of the UTF-8 representation of the client_secret value.

Returns:

a MAC signing key

toEncryptionCredential

@Nonnull
JWKCredential toEncryptionCredential(@Nonnull
 JWEAlgorithm alg,
 @Nonnull
 EncryptionMethod enc)
                              throws JOSEException

Create a symmetric encryption key derived from the client_secret and compatible with the key management mode and encryption algorithm specified.

Parameters:

alg - the key management mode

enc - the encryption algorithm

Returns:

a JWKCredential compatible with the 'alg' and 'enc' input

Throws:

JOSEException - if a key can not be derived