Package net.shibboleth.oidc.security.jwt.claims.impl

Class IssuedAtClaimsValidator

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator

All Implemented Interfaces:

ClaimsValidator, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

@ThreadSafeAfterInit
public class IssuedAtClaimsValidator
extends AbstractClaimsValidator

If the 'iat' claim is present in the JWT, verifies it is not to far away from the current time. The message lifetime, clock skew and the claim existence requirement can be configured.

Field Summary

Fields

Modifier and Type	Field	Description
private Duration	clockSkew	Clock skew adjustment in both directions to consider still acceptable (Default value: 1 minute).
private Duration	messageLifetime	Amount of time for which a message is valid after it is issued (Default value: 1 minute).
private boolean	requiredRule	Whether this rule is required to be met.

Constructor Summary

Constructors

Constructor	Description
IssuedAtClaimsValidator()	Constructor.

Method Summary

Modifier and Type	Method	Description
void	doValidate(com.nimbusds.jwt.JWTClaimsSet claims, ProfileRequestContext context)
void	setClockSkew(Duration skew)	Set the clock skew.
void	setMessageLifetime(Duration lifetime)	Sets the amount of time for which a message is valid.
void	setRequiredRule(boolean required)	Sets whether this rule is required to be met.

Methods inherited from class net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

setActivationCondition, validate

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

doInitialize, getId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiableComponent

setId

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

getId

Field Detail

clockSkew

@Nonnull
private Duration clockSkew

Clock skew adjustment in both directions to consider still acceptable (Default value: 1 minute).

messageLifetime

@Nonnull
private Duration messageLifetime

Amount of time for which a message is valid after it is issued (Default value: 1 minute).

requiredRule

private boolean requiredRule

Whether this rule is required to be met.

Constructor Detail

IssuedAtClaimsValidator

public IssuedAtClaimsValidator()

Constructor.

Method Detail

setMessageLifetime

public void setMessageLifetime(@Nonnull
                               Duration lifetime)

Sets the amount of time for which a message is valid.

Parameters:

lifetime - amount of time for which a message is valid

setClockSkew

public void setClockSkew(@Nonnull
                         Duration skew)

Set the clock skew.

Parameters:

skew - clock skew to set

setRequiredRule

public void setRequiredRule(boolean required)

Sets whether this rule is required to be met.

Parameters:

required - whether this rule is required to be met

doValidate

public void doValidate(@Nonnull
                       com.nimbusds.jwt.JWTClaimsSet claims,
                       @Nonnull
                       ProfileRequestContext context)
                throws JWTValidationException

Specified by:

doValidate in class AbstractClaimsValidator

Throws:

JWTValidationException