Package net.shibboleth.oidc.security.jwt.claims.impl

Class JWTIdentifierClaimsValidator

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

net.shibboleth.oidc.security.jwt.claims.impl.JWTIdentifierClaimsValidator

All Implemented Interfaces:

ClaimsValidator, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class JWTIdentifierClaimsValidator
extends AbstractClaimsValidator

Verifies the identifier (jit) from the JWT against replay via configurable ReplayCache.

Single identifier is stored in the cache for the lifetime of the JWT (expiration instant is taken from the 'exp' -claim).

Field Summary

Fields

Modifier and Type	Field	Description
private Duration	clockSkew	Clock skew adjustment in both directions to consider still acceptable (Default value: 1 minute).
private ReplayCache	replayCache	Message replay cache instance to use.

Constructor Summary

Constructors

Constructor	Description
JWTIdentifierClaimsValidator()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
protected void	doValidate(com.nimbusds.jwt.JWTClaimsSet claims, ProfileRequestContext context)
void	setClockSkew(Duration skew)	Set the clock skew.
void	setReplayCache(ReplayCache cache)	Set the replay cache instance to use.

Methods inherited from class net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

setActivationCondition, validate

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

getId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiableComponent

setId

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

getId

Field Detail

replayCache

@NonnullAfterInit
private ReplayCache replayCache

Message replay cache instance to use.

clockSkew

@Nonnull
private Duration clockSkew

Clock skew adjustment in both directions to consider still acceptable (Default value: 1 minute).

Constructor Detail

JWTIdentifierClaimsValidator

public JWTIdentifierClaimsValidator()

Constructor.

Method Detail

setReplayCache

public void setReplayCache(@Nonnull
                           ReplayCache cache)

Set the replay cache instance to use.

Parameters:

cache - replay cache to set.

setClockSkew

public void setClockSkew(@Nonnull
                         Duration skew)

Set the clock skew.

Parameters:

skew - clock skew to set.

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractIdentifiedInitializableComponent

Throws:

ComponentInitializationException

doValidate

protected void doValidate(@Nonnull
                          com.nimbusds.jwt.JWTClaimsSet claims,
                          @Nullable
                          ProfileRequestContext context)
                   throws JWTValidationException

Specified by:

doValidate in class AbstractClaimsValidator

Throws:

JWTValidationException