Package net.shibboleth.idp.plugin.oidc.op.security.jwt.claims.impl

Class ChainExpiryClaimsValidator

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

net.shibboleth.idp.plugin.oidc.op.security.jwt.claims.impl.ChainExpiryClaimsValidator

All Implemented Interfaces:

net.shibboleth.oidc.jwt.claims.ClaimsValidator, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

@ThreadSafeAfterInit
public class ChainExpiryClaimsValidator
extends net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

Iff a chain expiration time (c_exp) claim is present, verifies that it is ahead of the current time, else the JWT claims set is rejected. A few minutes of clockSkew is allowed.

Field Summary

Fields

Modifier and Type	Field	Description
private Duration	clockSkew	Positive clock skew adjustment to consider when checking JWT expiration (Default value: 60 seconds).
private org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Constructor	Description
ChainExpiryClaimsValidator()	Constructor.

Method Summary

Modifier and Type	Method	Description
void	doValidate(com.nimbusds.jwt.JWTClaimsSet claims, ProfileRequestContext context)
void	setClockSkew(Duration skew)	Set the clock skew.

Methods inherited from class net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

setActivationCondition, validate

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

doInitialize, getId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiableComponent

setId

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

getId

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

clockSkew

@Nonnull
private Duration clockSkew

Positive clock skew adjustment to consider when checking JWT expiration (Default value: 60 seconds).

Constructor Detail

ChainExpiryClaimsValidator

public ChainExpiryClaimsValidator()

Constructor.

Method Detail

setClockSkew

public void setClockSkew(@Nonnull
                         Duration skew)

Set the clock skew.

Parameters:

skew - clock skew to set

doValidate

public void doValidate(@Nonnull
                       com.nimbusds.jwt.JWTClaimsSet claims,
                       @Nonnull
                       ProfileRequestContext context)
                throws net.shibboleth.oidc.jwt.claims.JWTValidationException

Specified by:

doValidate in class net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

Throws:

net.shibboleth.oidc.jwt.claims.JWTValidationException