Package net.shibboleth.oidc.security.impl

Class ExplicitKeySignedJWTTrustEngine

java.lang.Object

net.shibboleth.oidc.security.impl.BaseSignedJWTTrustEngine<Iterable<Credential>>

net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine

All Implemented Interfaces:

TrustedCredentialTrustEngine<com.nimbusds.jwt.SignedJWT>, TrustEngine<com.nimbusds.jwt.SignedJWT>

Direct Known Subclasses:

ClientInformationJWTTrustEngine

public class ExplicitKeySignedJWTTrustEngine
extends BaseSignedJWTTrustEngine<Iterable<Credential>>
implements TrustedCredentialTrustEngine<com.nimbusds.jwt.SignedJWT>

An implementation of SignatureTrustEngine which evaluates the validity and trustworthiness of JWT signatures.

Processing is first performed as described in BaseSignedJWTTrustEngine. If based on this processing, it is determined that the token does not present or does not contain a resolveable valid (and trusted) signing key, then all trusted credentials obtained by the trusted credential resolver will be used to attempt to validate the signature.

Since:

2.2.0

Field Summary

Fields

Modifier and Type	Field	Description
private CredentialResolver	credentialResolver	Resolver used for resolving trusted credentials.
private ExplicitKeyTrustEvaluator	keyTrust	The external explicit key trust engine to use as a basis for trust in this implementation.
private org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Constructor	Description
ExplicitKeySignedJWTTrustEngine(CredentialResolver resolver, JOSEObjectCredentialResolver joseObjectResolver)	Constructor.

Method Summary

Modifier and Type	Method	Description
protected boolean	doValidate(com.nimbusds.jwt.SignedJWT signedJWT, CriteriaSet trustBasisCriteria)	Validate the signed JWT using the supplied trust criteria.
protected boolean	evaluateTrust(Credential untrustedCredential, Iterable<Credential> trustedCredentials)	Evaluate the untrusted KeyInfo-derived credential with respect to the specified trusted information.
CredentialResolver	getCredentialResolver()

Methods inherited from class net.shibboleth.oidc.security.impl.BaseSignedJWTTrustEngine

checkParams, resolveTokenCredentials, validate, validate, verifySignature

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.opensaml.security.trust.TrustEngine

validate

Field Detail

log

private final org.slf4j.Logger log

Class logger.

credentialResolver

private final CredentialResolver credentialResolver

Resolver used for resolving trusted credentials.

keyTrust

private final ExplicitKeyTrustEvaluator keyTrust

The external explicit key trust engine to use as a basis for trust in this implementation.

Constructor Detail

ExplicitKeySignedJWTTrustEngine

public ExplicitKeySignedJWTTrustEngine(@Nonnull @ParameterName(name="resolver")
                                       CredentialResolver resolver,
                                       @Nonnull @ParameterName(name="JOSEObjectResolver")
                                       JOSEObjectCredentialResolver joseObjectResolver)

Constructor.

Parameters:

resolver - credential resolver used to resolve trusted credentials.

joseObjectResolver - resolver which resolve credentials from the headers of a JOSEObject instance.

Method Detail

getCredentialResolver

@Nonnull
public CredentialResolver getCredentialResolver()

Specified by:

getCredentialResolver in interface TrustedCredentialTrustEngine<com.nimbusds.jwt.SignedJWT>

doValidate

protected boolean doValidate(@Nonnull
                             com.nimbusds.jwt.SignedJWT signedJWT,
                             @Nonnull
                             CriteriaSet trustBasisCriteria)
                      throws SecurityException

Description copied from class: BaseSignedJWTTrustEngine

Validate the signed JWT using the supplied trust criteria.

Specified by:

doValidate in class BaseSignedJWTTrustEngine<Iterable<Credential>>

Parameters:

signedJWT - the signed JWT to validate

trustBasisCriteria - criteria used to describe and/or resolve the information which serves as the basis for trust evaluation

Returns:

true if signature is valid and trusted, false otherwise

Throws:

SecurityException - if there is a fatal error evaluating the signature

evaluateTrust

protected boolean evaluateTrust(@Nonnull
                                Credential untrustedCredential,
                                @Nonnull
                                Iterable<Credential> trustedCredentials)
                         throws SecurityException

Description copied from class: BaseSignedJWTTrustEngine

Evaluate the untrusted KeyInfo-derived credential with respect to the specified trusted information.

Specified by:

evaluateTrust in class BaseSignedJWTTrustEngine<Iterable<Credential>>

Parameters:

untrustedCredential - the untrusted credential being evaluated

trustedCredentials - the information which serves as the basis for trust evaluation

Returns:

true if the trust can be established for the untrusted credential, otherwise false

Throws:

SecurityException - if an error occurs during trust processing