Package net.shibboleth.oidc.security.impl

Class JWETokenDecrypter

java.lang.Object
net.shibboleth.oidc.security.impl.JWETokenDecrypter
public class JWETokenDecrypter extends Object
Supports decryption of encrypted JSON Web Tokens using the JSON Web Encryption standard. The EncryptedJWT will be decrypted in-place, with its JWEObject.State changing to JWEObject.State.DECRYPTED on successful decryption. Any error that occurs decrypting the JWT will throw an DecryptionException.

A decrypter should be created for each new decryption operation.

Since:
2.2.0

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • params

      @Nonnull private final DecryptionParameters params
      The JWT decryption parameters.

  • Constructor Details

    • JWETokenDecrypter

      public JWETokenDecrypter(@Nonnull DecryptionParameters decryptionParams)
      Constructor.
      Parameters:
      decryptionParams - the parameters to use during decryption

  • Method Details

    • decrypt

      @Nonnull public JWT decrypt(@Nonnull EncryptedJWT encryptedObject) throws DecryptionException
      Decrypt a JWE object using credentials resolved from the CEK and KEK resolvers inside the decryption parameters. Supports Direct Encryption, Key Encryption, Key Wrapping, and Key Agreement management modes.
      Parameters:
      encryptedObject - JWE object to decrypt.
      Returns:
      Decrypted JWT object.
      Throws:
      DecryptionException - on failure to decrypt the JWT.

    • buildCriteria

      @Nonnull private CriteriaSet buildCriteria(@Nonnull EncryptedJWT encryptedObject, @Nullable List<Criterion> criteria)
      Build a criteria set using the additional criteria in the params, those supplied, and those that relate to the encrypted JWT.
      Parameters:
      encryptedObject - the encrypted JWT to build criterion from
      criteria - criteria supplied, can be null.
      Returns:
      the build criteria set.

    • buildKeyManagementAlgorithmCriteria

      private void buildKeyManagementAlgorithmCriteria(@Nonnull CriteriaSet criteriaSet, @Nonnull EncryptedJWT encryptedObject)
      Optionally build decryption key 'alg' (key management algorithm) credential criteria according to information in the encrypted object.
      Parameters:
      criteriaSet - the criteria set to add built criteria too
      encryptedObject - the encrypted JWT from which to deduce decryption key 'alg' criteria

    • buildContentEncryptionKeyAlgorithmCriteria

      private void buildContentEncryptionKeyAlgorithmCriteria(@Nonnull CriteriaSet criteriaSet, @Nonnull EncryptedJWT encryptedObject)
      Optionally build decryption key 'enc' (encryption key algorithm) credential criteria according to information in the encrypted object.
      Parameters:
      criteriaSet - the criteria
      encryptedObject - the encrypted JWT from which to deduce decryption key 'enc' criteria

    • buildKeyAlgorithmCriteria

      @Nullable private KeyAlgorithmCriterion buildKeyAlgorithmCriteria(@Nullable String algorithmURI)
      Dynamically construct key algorithm credential criteria based on the specified algorithm URI.
      Parameters:
      algorithmURI - the algorithm URI
      Returns:
      a new key algorithm credential criteria instance, or null if criteria could not be determined

    • buildKeyLengthCriteria

      @Nullable private KeyLengthCriterion buildKeyLengthCriteria(@Nullable String encAlgorithmURI)
      Dynamically construct key length credential criteria based on the specified algorithm URI.
      Parameters:
      encAlgorithmURI - the algorithm URI
      Returns:
      a new key length credential criteria instance, or null if the value could not be determined

    • decryptUsingKeyAgreement

      private void decryptUsingKeyAgreement(@Nonnull EncryptedJWT encryptedObject) throws DecryptionException
      Decrypt the encrypted JWT by computing the content encryption key using Elliptic Curve Diffie-Hellman key agreement. The private EC key is resolved from the DecryptionParameters.getKEKCredentialResolver().

      For each credential, algorithm compatibly is checked against that described by the JWE and any includes and excludes lists configured.

      The process terminates when a resolved credential decrypts the JWT. The resolvers should only retrieve appropriate keys, but that is not guaranteed.

      Parameters:
      encryptedObject - the encrypted JWT to decrypt - in place.
      Throws:
      DecryptionException - if any of the resolved credentials could not be used to decrypt the JWT.

    • decryptUsingKeyWrapping

      private void decryptUsingKeyWrapping(@Nonnull EncryptedJWT encryptedObject) throws DecryptionException
      Decrypt the encrypted JWT by first decrypting the wrapped content encryption key using one of the shared key wrapping keys derived from a symmetric key resolved by the DecryptionParameters.getKEKCredentialResolver() resolver.

      For each credential, algorithm compatibly is checked against that described by the JWE and any includes and excludes lists configured.

      The process terminates when the first resolved credential (that decrypts the CEK) decrypts the JWT. The resolvers should only retrieve appropriate keys, but that is not guaranteed.

      Parameters:
      encryptedObject - the encrypted JWT to decrypt - in place.
      Throws:
      DecryptionException - if the resolved credentials could not be used to decrypt the JWT.

    • decryptUsingKeyEncryption

      private void decryptUsingKeyEncryption(@Nonnull EncryptedJWT encryptedObject) throws DecryptionException
      Decrypt the encrypted JWT by first decrypting the content encryption key using one of the (asymmetric) key encryption keys resolved by the DecryptionParameters.getKEKCredentialResolver() resolver.

      For each credential, algorithm compatibly is checked against that described by the JWE and any includes and excludes lists configured.

      The process terminates when the first resolved credential (that decrypts the CEK) decrypts the JWT. The resolvers should only retrieve appropriate keys, but that is not guaranteed.

      Parameters:
      encryptedObject - the encrypted JWT to decrypt - in place.
      Throws:
      DecryptionException - if the resolved credentials could not be used to decrypt the JWT.

    • decryptUsingDirectEncryption

      private void decryptUsingDirectEncryption(@Nonnull EncryptedJWT encryptedObject) throws DecryptionException
      Decrypt the encrypted JWT using direct encryption. One of the shared symmetric keys resolved by the DecryptionParameters.getContentEncryptionKeyCredentialResolver() is used to derive a content encryption key to decrypt the JWT - if any are appropriate.

      For each credential, algorithm compatibly is checked against that described by the JWE and any includes and excludes lists configured.

      The first resolved (and derived) credential that decrypts the JWT produces a result, and the process terminates. The resolvers should only retrieve appropriate keys, but that is not guaranteed.

      Parameters:
      encryptedObject - the encrypted JWT to decrypt - in place.
      Throws:
      DecryptionException - if the resolved credentials could not be used to decrypt the JWT.

    • validateKeyManagmentAlgorithm

      @Nonnull private JWEAlgorithm validateKeyManagmentAlgorithm(@Nonnull EncryptedJWT encryptedObject, @Nonnull JWKCredential cred) throws DecryptionException
      If the credential contains algorithm 'alg' information, validate the 'alg' algorithm in the JWT JOSE header matches the algorithm specified for the credential. Then, validates the algorithm in the JWT JOSE Header against the include and exclude algorithm URI lists. Finally, validates the credential contains the correct key type.
      Parameters:
      encryptedObject - the JWE
      cred - the credential to validate against the 'alg' header
      Returns:
      the validated algorithm to use
      Throws:
      DecryptionException - if there is an algorithm mismatch.

    • validateContentEncryptionAlgorithm

      @Nonnull private EncryptionMethod validateContentEncryptionAlgorithm(@Nonnull EncryptedJWT encryptedObject) throws DecryptionException
      Validates the 'enc' algorithm in the header against the include and exclude algorithm URI lists. If valid, the encryption algorithm from the header is returned. If not valid, an DecryptionException is thrown.
      Parameters:
      encryptedObject - the JWE
      Returns:
      the content encryption algorithm from the JOSE header.
      Throws:
      DecryptionException - if there is an algorithm mismatch.

    • validateContentEncryptionAlgorithm

      @Nonnull private EncryptionMethod validateContentEncryptionAlgorithm(@Nonnull EncryptedJWT encryptedObject, @Nonnull JWKCredential cred) throws DecryptionException
      Validates the 'enc' algorithm in the header matches the encryption algorithm specified for the credential, and validates against the include and exclude algorithm URI lists. If valid, the encryption algorithm from the header is returned. If not valid, an DecryptionException is thrown.
      Parameters:
      encryptedObject - the JWE
      cred - the credential to validate the 'enc' header
      Returns:
      the content encryption algorithm from the JOSE header.
      Throws:
      DecryptionException - if there is an algorithm mismatch.

    • validateAlgorithmURI

      private void validateAlgorithmURI(@Nullable String algorithmURI) throws DecryptionException
      Validate the supplied algorithm URI against the configured include and exclude lists.
      Parameters:
      algorithmURI - the algorithm URI to evaluate
      Throws:
      DecryptionException - if the algorithm URI does not satisfy the include/exclude policy