Package net.shibboleth.oidc.security.jwt.claims.impl

Class JWTIdentifierClaimsValidator

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator
net.shibboleth.oidc.security.jwt.claims.impl.JWTIdentifierClaimsValidator
All Implemented Interfaces:
ClaimsValidator, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
public class JWTIdentifierClaimsValidator extends AbstractClaimsValidator
Verifies the identifier (jit) from the JWT against replay via configurable ReplayCache.

Single identifier is stored in the cache for the lifetime of the JWT (expiration instant is taken from the 'exp' -claim if found, with configurable default and maximum lifetime).

  • Field Details

    • replayCache

      @NonnullAfterInit private ReplayCache replayCache
      Message replay cache instance to use.

    • clockSkew

      @Nonnull private Duration clockSkew
      Clock skew adjustment in both directions to consider still acceptable (Default value: 1 minute).

    • replayCacheRecordLifetime

      @Nullable private Duration replayCacheRecordLifetime
      Static lifetime to be used in replay cache if claims set doesn't contain expiration value.

    • maxReplayCacheRecordLifetime

      @Nullable private Duration maxReplayCacheRecordLifetime
      Maximum lifetime to be used in replay cache when 'exp' claim is exploited.

    • replayCacheKeyCalculationStrategy

      @Nullable private Function<String,String> replayCacheKeyCalculationStrategy
      Optional function to calculate they key used with ReplayCache.

  • Constructor Details

    • JWTIdentifierClaimsValidator

      public JWTIdentifierClaimsValidator()
      Constructor.

  • Method Details

    • setReplayCache

      public void setReplayCache(@Nonnull ReplayCache cache)
      Set the replay cache instance to use.
      Parameters:
      cache - replay cache to set.

    • setClockSkew

      public void setClockSkew(@Nonnull Duration skew)
      Set the clock skew.
      Parameters:
      skew - clock skew to set.

    • setReplayCacheRecordLifetime

      public void setReplayCacheRecordLifetime(@Nullable Duration lifetime)
      Set the static lifetime to be used in replay cache if claims set doesn't contain expiration value.
      Parameters:
      lifetime - record lifetime to set.
      Since:
      3.2.0

    • setMaxReplayCacheRecordLifetime

      public void setMaxReplayCacheRecordLifetime(@Nullable Duration lifetime)
      Set the maximum lifetime to be used in replay cache when 'exp' claim is exploited.
      Parameters:
      lifetime - record lifetime to set.
      Since:
      3.2.0

    • setReplayCacheKeyCalculationStrategy

      public void setReplayCacheKeyCalculationStrategy(@Nullable Function<String,String> strategy)
      Set the function to calculate they key used with ReplayCache.
      Parameters:
      strategy - function to set.
      Since:
      3.2.0

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractIdentifiedInitializableComponent
      Throws:
      ComponentInitializationException

    • doValidate

      protected void doValidate(@Nonnull JWTClaimsSet claims, @Nullable ProfileRequestContext context) throws JWTValidationException
      Perform validation of the given claims supported by the supplied context.
      Specified by:
      doValidate in class AbstractClaimsValidator
      Parameters:
      claims - the claims to validate.
      context - the profile request context.
      Throws:
      JWTValidationException - when validation is unsuccessful due to a failed attempt