Package net.shibboleth.oidc.security.impl

Class JWTSignatureValidationUtil

java.lang.Object

net.shibboleth.oidc.security.impl.JWTSignatureValidationUtil

public final class JWTSignatureValidationUtil
extends Object

Generic utility class for helping JWT signature validation.

Field Summary

Fields

Modifier and Type	Field	Description
private static org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Modifier	Constructor	Description
private	JWTSignatureValidationUtil()	Private constructor.

Method Summary

Modifier and Type	Method	Description
private static JWSVerifier	initializeVerifier(Algorithm algorithm, Credential credential)	Initializes a JWSVerifier for the given algorithm, using the provided Credential.
static String	validateSignatureEx(Collection<? extends Credential> credentials, SignedJWT signedJwt, String invalidJwtEventId)	Validates the signature of the given JWS against the given list of credentials.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

log

@Nonnull
private static org.slf4j.Logger log

Class logger.

Constructor Details

JWTSignatureValidationUtil

private JWTSignatureValidationUtil()

Private constructor.

Method Details

validateSignatureEx

public static String validateSignatureEx(@Nonnull
 Collection<? extends Credential> credentials,
 @Nonnull
 SignedJWT signedJwt,
 @Nullable
 String invalidJwtEventId)

Validates the signature of the given JWS against the given list of credentials. If the validation fails for any reason, including insufficient prequisities in the context, an event identifier is returned. Successful validation produces null result.

Parameters:

credentials - The list of Credentials to use for signature validation.

signedJwt - The signed JWT to be validated.

invalidJwtEventId - The event identifier describing the invalid JWT.

Returns:

an event ID on failure, or null if validation succeeds.

initializeVerifier

@Nullable
private static JWSVerifier initializeVerifier(@Nonnull
 Algorithm algorithm,
 @Nonnull
 Credential credential)
                                       throws JOSEException

Initializes a JWSVerifier for the given algorithm, using the provided Credential.

Parameters:

algorithm - The algorithm used for deciding the verifier.

credential - The credential to be used for the verifier.

Returns:

A corresponding verifier, or null if no supported found.

Throws:

JOSEException - If the credential doesn't meet the verifier requirements.