Package net.shibboleth.oidc.security.impl

Class JWTMessageSignatureSecurityHandler

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

net.shibboleth.oidc.security.impl.BaseJWTSignatureSecurityHandler

net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

public class JWTMessageSignatureSecurityHandler
extends BaseJWTSignatureSecurityHandler

A MessageHandler that uses a TrustEngine to evaluate the signature of a signed JWT.

Note, if the JWT is not in a signed state an exception will be thrown i.e. JWTs must be signed by the time this handler executes.

Also, the JWT must also have claims, otherwise an exception is throw. This restriction could be lifted if it is feasible to check the signature of a JWT with a null payload - even if pointless?

Field Summary

Fields

Modifier and Type	Field	Description
private com.nimbusds.jwt.JWTClaimsSet	claimsSet	The stashed claims set belonging to the JWT.
private Function<MessageContext,com.nimbusds.jwt.SignedJWT>	jwtTokenLookupStrategy	Function that looks up a signed JWT token from the given message context to validate.
private org.slf4j.Logger	log	Logger.
private com.nimbusds.jwt.SignedJWT	signedJwt	The extracted signed JWT that is to be validated.

Constructor Summary

Constructors

Constructor	Description
JWTMessageSignatureSecurityHandler()

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
protected void	doInvoke(MessageContext messageContext)
protected boolean	doPreInvoke(MessageContext messageContext)
void	setJwtTokenLookupStrategy(Function<MessageContext,com.nimbusds.jwt.SignedJWT> strategy)	Set the strategy used to look up a signed JWT token.

Methods inherited from class net.shibboleth.oidc.security.impl.BaseJWTSignatureSecurityHandler

adapt, buildCriteriaSet, getOIDCPeerEntityContext, resolveTrustEngine, setClientInformationLookupStrategy, setProviderMetadataLookupStrategy, setRelyingPartyContextLookupStrategy, setSecurityParametersContextLookupStrategy

Methods inherited from class org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler

evaluate, evaluate, getTrustEngine

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, setActivationCondition

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Logger.

jwtTokenLookupStrategy

@NonnullAfterInit
private Function<MessageContext,com.nimbusds.jwt.SignedJWT> jwtTokenLookupStrategy

Function that looks up a signed JWT token from the given message context to validate.

signedJwt

@Nullable
private com.nimbusds.jwt.SignedJWT signedJwt

The extracted signed JWT that is to be validated.

claimsSet

@Nullable
private com.nimbusds.jwt.JWTClaimsSet claimsSet

The stashed claims set belonging to the JWT.

Constructor Detail

JWTMessageSignatureSecurityHandler

public JWTMessageSignatureSecurityHandler()

Method Detail

setJwtTokenLookupStrategy

public void setJwtTokenLookupStrategy(@Nonnull
                                      Function<MessageContext,com.nimbusds.jwt.SignedJWT> strategy)

Set the strategy used to look up a signed JWT token.

Parameters:

strategy - lookup strategy

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreInvoke

protected boolean doPreInvoke(MessageContext messageContext)
                       throws MessageHandlerException

Overrides:

doPreInvoke in class BaseJWTSignatureSecurityHandler

Throws:

MessageHandlerException

doInvoke

protected void doInvoke(MessageContext messageContext)
                 throws MessageHandlerException

Specified by:

doInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException