Package net.shibboleth.oidc.security.impl

Class JWTMessageSignatureSecurityHandler

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler<SignedJWT>

net.shibboleth.oidc.security.impl.BaseJWTSignatureSecurityHandler

net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

public class JWTMessageSignatureSecurityHandler
extends BaseJWTSignatureSecurityHandler

A MessageHandler that uses a TrustEngine to evaluate the signature of a signed JWT.

Note, if the JWT is not in a signed state an exception will be thrown i.e. JWTs must be signed by the time this handler executes.

Also, the JWT must also have claims, otherwise an exception is throw. This restriction could be lifted if it is feasible to check the signature of a JWT with a null payload - even if pointless?

Field Summary

Fields

Modifier and Type	Field	Description
private Function<MessageContext,SignedJWT>	jwtTokenLookupStrategy	Function that looks up a signed JWT token from the given message context to validate.
private final org.slf4j.Logger	log	Logger.
private SignedJWT	signedJwt	The extracted signed JWT that is to be validated.

Constructor Summary

Constructors

Constructor	Description
JWTMessageSignatureSecurityHandler()

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
protected void	doInvoke(MessageContext messageContext)
protected boolean	doPreInvoke(MessageContext messageContext)
void	setJwtTokenLookupStrategy(Function<MessageContext,SignedJWT> strategy)	Set the strategy used to look up a signed JWT token.

Methods inherited from class net.shibboleth.oidc.security.impl.BaseJWTSignatureSecurityHandler

adapt, buildCriteriaSet, getOIDCPeerEntityContext, resolveTrustEngine, setClientInformationLookupStrategy, setProviderMetadataLookupStrategy, setRelyingPartyContextLookupStrategy, setSecurityParametersContextLookupStrategy

Methods inherited from class org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler

evaluate, evaluate, getTrustEngine

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, isPreInvokeCalled, setActivationCondition

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Logger.

jwtTokenLookupStrategy

@NonnullAfterInit
private Function<MessageContext,SignedJWT> jwtTokenLookupStrategy

Function that looks up a signed JWT token from the given message context to validate.

signedJwt

@NonnullBeforeExec
private SignedJWT signedJwt

The extracted signed JWT that is to be validated.

Constructor Details

JWTMessageSignatureSecurityHandler

public JWTMessageSignatureSecurityHandler()

Method Details

setJwtTokenLookupStrategy

public void setJwtTokenLookupStrategy(@Nonnull
 Function<MessageContext,SignedJWT> strategy)

Set the strategy used to look up a signed JWT token.

Parameters:

strategy - lookup strategy

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreInvoke

protected boolean doPreInvoke(@Nonnull
 MessageContext messageContext)
                       throws MessageHandlerException

Overrides:

doPreInvoke in class BaseJWTSignatureSecurityHandler

Throws:

MessageHandlerException

doInvoke

protected void doInvoke(@Nonnull
 MessageContext messageContext)
                 throws MessageHandlerException

Specified by:

doInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException