Package net.shibboleth.oidc.security.impl

Class BaseSignedJWTTrustEngine<TrustBasisType>

java.lang.Object
net.shibboleth.oidc.security.impl.BaseSignedJWTTrustEngine<TrustBasisType>
Type Parameters:
TrustBasisType - the trust basis type
All Implemented Interfaces:
TrustEngine<SignedJWT>
Direct Known Subclasses:
ExplicitKeySignedJWTTrustEngine, TokenAsymmetricKeyTrustEngine
public abstract class BaseSignedJWTTrustEngine<TrustBasisType> extends Object implements TrustEngine<SignedJWT>
A TrustEngine implementation for Signed JSON Web Tokens.
Since:
2.2.0

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Logger.

    • joseObjectCredentialResolver

      @Nonnull private final JOSEObjectCredentialResolver joseObjectCredentialResolver
      Resolver of credentials from JOSEObject headers.

  • Constructor Details

    • BaseSignedJWTTrustEngine

      protected BaseSignedJWTTrustEngine(@Nonnull JOSEObjectCredentialResolver joseObjectResolver)
      Constructor.
      Parameters:
      joseObjectResolver - resolver of credentials from JOSEObject headers.

  • Method Details

    • validate

      public boolean validate(@Nonnull SignedJWT signedJWT, @Nullable CriteriaSet trustBasisCriteria) throws SecurityException
      Specified by:
      validate in interface TrustEngine<TrustBasisType>
      Throws:
      SecurityException

    • doValidate

      protected abstract boolean doValidate(@Nonnull SignedJWT signedJWT, @Nonnull CriteriaSet trustBasisCriteria) throws SecurityException
      Validate the signed JWT using the supplied trust criteria.
      Parameters:
      signedJWT - the signed JWT to validate
      trustBasisCriteria - criteria used to describe and/or resolve the information which serves as the basis for trust evaluation
      Returns:
      true if signature is valid and trusted, false otherwise
      Throws:
      SecurityException - if there is a fatal error evaluating the signature

    • validate

      protected boolean validate(@Nonnull SignedJWT signedJWT, @Nullable TrustBasisType trustBasis) throws SecurityException
      Attempt to establish trust by resolving token verification credentials from the token itself. If any credentials so resolved correctly verify the signature, attempt to establish trust using subclass-specific trust logic against trusted information as implemented in evaluateTrust(Credential, Object).
      Parameters:
      signedJWT - the signed JWT to evaluate
      trustBasis - the information which serves as the basis for trust evaluation
      Returns:
      true if the signature is verified by any token-derived credential which can be established as trusted, otherwise false
      Throws:
      SecurityException - if an error occurs during signature verification or trust processing

    • verifySignature

      protected boolean verifySignature(@Nonnull SignedJWT signedJWT, @Nonnull Credential credential) throws SecurityException
      Attempt to verify a signature using the key from the supplied credential.
      Parameters:
      signedJWT - the JWT on which to attempt verification
      credential - the credential containing the candidate validation key
      Returns:
      true if the signature can be verified using the key from the credential, otherwise false
      Throws:
      SecurityException - if there is a fatal error evaluating the signature

    • initializeVerifier

      private static JWSVerifier initializeVerifier(Algorithm algorithm, Credential credential) throws JOSEException
      Initializes a JWSVerifier for the given algorithm, using the provided Credential.
      Parameters:
      algorithm - The algorithm used for deciding the verifier.
      credential - The credential to be used for the verifier.
      Returns:
      A corresponding verifier, or null if no supported found.
      Throws:
      JOSEException - If the credential doesn't meet the verifier requirements.

    • evaluateTrust

      protected abstract boolean evaluateTrust(@Nonnull Credential untrustedCredential, @Nullable TrustBasisType trustBasis) throws SecurityException
      Evaluate the untrusted KeyInfo-derived credential with respect to the specified trusted information.
      Parameters:
      untrustedCredential - the untrusted credential being evaluated
      trustBasis - the information which serves as the basis for trust evaluation
      Returns:
      true if the trust can be established for the untrusted credential, otherwise false
      Throws:
      SecurityException - if an error occurs during trust processing

    • checkParams

      protected void checkParams(@Nullable SignedJWT signedJWT, @Nullable CriteriaSet trustBasisCriteria) throws SecurityException
      Check the signed JWT and supplied criteria for required values.
      Parameters:
      signedJWT - the signed JWT to be evaluated
      trustBasisCriteria - the set of trusted credential criteria
      Throws:
      SecurityException - thrown if required values are absent or otherwise invalid

    • resolveTokenCredentials

      @Nonnull protected Collection<Credential> resolveTokenCredentials(@Nonnull SignedJWT signedJWT) throws SecurityException
      Resolve any credentials indicated in the token, such as by inline JWK.
      Parameters:
      signedJWT - the signed JWT to be evaluated
      Returns:
      a collection of credentials derived from the token, may be empty
      Throws:
      SecurityException - thrown if here is a fatal exception resolving credentials