Package net.shibboleth.oidc.security.impl

Class TokenAsymmetricKeyTrustEngine

java.lang.Object

net.shibboleth.oidc.security.impl.BaseSignedJWTTrustEngine<Credential>

net.shibboleth.oidc.security.impl.TokenAsymmetricKeyTrustEngine

All Implemented Interfaces:

TrustEngine<SignedJWT>

public class TokenAsymmetricKeyTrustEngine
extends BaseSignedJWTTrustEngine<Credential>

A TrustEngine implementation for Signed JSON Web Tokens. The token derived public key is used as the trust basis.

Since:

3.2.0

Field Summary

Fields

Modifier and Type	Field	Description
private final org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	TokenAsymmetricKeyTrustEngine(JOSEObjectCredentialResolver joseObjectResolver)	Constructor.

Method Summary

Modifier and Type	Method	Description
protected boolean	doValidate(SignedJWT signedJWT, CriteriaSet trustBasisCriteria)	Validate the signed JWT using the supplied trust criteria.
protected boolean	evaluateTrust(Credential untrustedCredential, Credential trustBasis)	Evaluate the untrusted KeyInfo-derived credential with respect to the specified trusted information.

Methods inherited from class net.shibboleth.oidc.security.impl.BaseSignedJWTTrustEngine

checkParams, resolveTokenCredentials, validate, validate, verifySignature

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

Constructor Details

TokenAsymmetricKeyTrustEngine

protected TokenAsymmetricKeyTrustEngine(@Nonnull @ParameterName(name="JOSEObjectResolver")
 JOSEObjectCredentialResolver joseObjectResolver)

Constructor.

Parameters:

joseObjectResolver - resolver of credentials from JOSEObject headers.

Method Details

doValidate

protected boolean doValidate(@Nonnull
 SignedJWT signedJWT,
 @Nonnull
 CriteriaSet trustBasisCriteria)
                      throws SecurityException

Description copied from class: BaseSignedJWTTrustEngine

Validate the signed JWT using the supplied trust criteria.

Specified by:

doValidate in class BaseSignedJWTTrustEngine<Credential>

Parameters:

signedJWT - the signed JWT to validate

trustBasisCriteria - criteria used to describe and/or resolve the information which serves as the basis for trust evaluation

Returns:

true if signature is valid and trusted, false otherwise

Throws:

SecurityException - if there is a fatal error evaluating the signature

evaluateTrust

protected boolean evaluateTrust(@Nonnull
 Credential untrustedCredential,
 @Nullable
 Credential trustBasis)
                         throws SecurityException

Description copied from class: BaseSignedJWTTrustEngine

Evaluate the untrusted KeyInfo-derived credential with respect to the specified trusted information.

Specified by:

evaluateTrust in class BaseSignedJWTTrustEngine<Credential>

Parameters:

untrustedCredential - the untrusted credential being evaluated

trustBasis - the information which serves as the basis for trust evaluation

Returns:

true if the trust can be established for the untrusted credential, otherwise false

Throws:

SecurityException - if an error occurs during trust processing