Package net.shibboleth.oidc.security.impl

Class BaseSignedJWTTrustEngine<TrustBasisType>

  • Type Parameters:
    TrustBasisType - the trust basis type
    All Implemented Interfaces:
    TrustEngine<com.nimbusds.jwt.SignedJWT>
    Direct Known Subclasses:
    ExplicitKeySignedJWTTrustEngine
    public abstract class BaseSignedJWTTrustEngine<TrustBasisType>
extends Object
implements TrustEngine<com.nimbusds.jwt.SignedJWT>
    A TrustEngine implementation for Signed JSON Web Tokens.
    Since:
    2.2.0

    • Field Detail

      • log

        private final org.slf4j.Logger log
        Logger.

      • joseObjectCredentialResolver

        private final JOSEObjectCredentialResolver joseObjectCredentialResolver
        Resolver of credentials from JOSEObject headers.

    • Constructor Detail

      • BaseSignedJWTTrustEngine

        protected BaseSignedJWTTrustEngine​(@Nonnull
                                   JOSEObjectCredentialResolver joseObjectResolver)
        Constructor.
        Parameters:
        joseObjectResolver - resolver of credentials from JOSEObject headers.

    • Method Detail

      • doValidate

        protected abstract boolean doValidate​(@Nonnull
                                      com.nimbusds.jwt.SignedJWT signedJWT,
                                      @Nonnull
                                      CriteriaSet trustBasisCriteria)
                               throws SecurityException
        Validate the signed JWT using the supplied trust criteria.
        Parameters:
        signedJWT - the signed JWT to validate
        trustBasisCriteria - criteria used to describe and/or resolve the information which serves as the basis for trust evaluation
        Returns:
        true if signature is valid and trusted, false otherwise
        Throws:
        SecurityException - if there is a fatal error evaluating the signature

      • validate

        protected boolean validate​(@Nonnull
                           com.nimbusds.jwt.SignedJWT signedJWT,
                           @Nullable
                           TrustBasisType trustBasis)
                    throws SecurityException
        Attempt to establish trust by resolving token verification credentials from the token itself. If any credentials so resolved correctly verify the signature, attempt to establish trust using subclass-specific trust logic against trusted information as implemented in evaluateTrust(Credential, Object).
        Parameters:
        signedJWT - the signed JWT to evaluate
        trustBasis - the information which serves as the basis for trust evaluation
        Returns:
        true if the signature is verified by any token-derived credential which can be established as trusted, otherwise false
        Throws:
        SecurityException - if an error occurs during signature verification or trust processing

      • verifySignature

        protected boolean verifySignature​(@Nonnull
                                  com.nimbusds.jwt.SignedJWT signedJWT,
                                  @Nonnull
                                  Credential credential)
                           throws SecurityException
        Attempt to verify a signature using the key from the supplied credential.
        Parameters:
        signedJWT - the JWT on which to attempt verification
        credential - the credential containing the candidate validation key
        Returns:
        true if the signature can be verified using the key from the credential, otherwise false
        Throws:
        SecurityException - if there is a fatal error evaluating the signature

      • initializeVerifier

        private static com.nimbusds.jose.JWSVerifier initializeVerifier​(com.nimbusds.jose.Algorithm algorithm,
                                                                Credential credential)
                                                         throws com.nimbusds.jose.JOSEException
        Initializes a JWSVerifier for the given algorithm, using the provided Credential.
        Parameters:
        algorithm - The algorithm used for deciding the verifier.
        credential - The credential to be used for the verifier.
        Returns:
        A corresponding verifier, or null if no supported found.
        Throws:
        com.nimbusds.jose.JOSEException - If the credential doesn't meet the verifier requirements.

      • evaluateTrust

        protected abstract boolean evaluateTrust​(@Nonnull
                                         Credential untrustedCredential,
                                         @Nullable
                                         TrustBasisType trustBasis)
                                  throws SecurityException
        Evaluate the untrusted KeyInfo-derived credential with respect to the specified trusted information.
        Parameters:
        untrustedCredential - the untrusted credential being evaluated
        trustBasis - the information which serves as the basis for trust evaluation
        Returns:
        true if the trust can be established for the untrusted credential, otherwise false
        Throws:
        SecurityException - if an error occurs during trust processing

      • checkParams

        protected void checkParams​(@Nonnull
                           com.nimbusds.jwt.SignedJWT signedJWT,
                           @Nonnull
                           CriteriaSet trustBasisCriteria)
                    throws SecurityException
        Check the signed JWT and supplied criteria for required values.
        Parameters:
        signedJWT - the signed JWT to be evaluated
        trustBasisCriteria - the set of trusted credential criteria
        Throws:
        SecurityException - thrown if required values are absent or otherwise invalid

      • resolveTokenCredentials

        @Nonnull
protected Collection<Credential> resolveTokenCredentials​(@Nonnull
                                                         com.nimbusds.jwt.SignedJWT signedJWT)
                                                  throws SecurityException
        Resolve any credentials indicated in the token, such as by inline JWK.
        Parameters:
        signedJWT - the signed JWT to be evaluated
        Returns:
        a collection of credentials derived from the token, may be empty
        Throws:
        SecurityException - thrown if here is a fatal exception resolving credentials