com.identityx.auth.impl.JoseRequestAuthenticator Maven / Gradle / Ivy

Go to download
Show more of this group Show more artifacts with this name
Show all versions of daon-http-digest-auth Show documentation
Client library used for adding authentication to http messages as required by IdentityX Rest Services
There is a newer version: 5.6.0.2
Show newest version
/*
* Copyright Daon.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*     http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package com.identityx.auth.impl;

import java.io.UnsupportedEncodingException;
import java.security.PrivateKey;
import java.text.MessageFormat;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.identityx.auth.def.ITokenKey;
import com.identityx.auth.impl.keys.PrivateApiKey;
import com.identityx.auth.support.RequestAuthenticationException;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSObject;
import com.nimbusds.jose.JWSSigner;
import com.nimbusds.jose.Payload;
import com.nimbusds.jose.crypto.RSASSASigner;


public class JoseRequestAuthenticator extends DigestRequestAuthenticator {

	private static final Log log = LogFactory.getLog(JoseRequestAuthenticator.class);
	public static final String AUTHENTICATION_SCHEME = "JWS";
    private JWSAlgorithm currentAlgorithm = JWSAlgorithm.RS256;
    public static final String JWS = "JWS";
    public static final String SIGNED_HEADERS = "SignedHeaders";
    public static final String SIGNATURE_ID = "signatureId";
    
    
    public String buildAuthorizationHeader(final String canonicalRequestHashHex, String signedHeadersString, final ITokenKey apiKey, final String dateStamp, final String timeStamp, final String nonce) 
    		throws UnsupportedEncodingException {
    	
    	if (!(apiKey instanceof PrivateApiKey)) {
    		throw new IllegalArgumentException("apiKey needs to be of type AsymApiKey");
    	}
    	PrivateKey privateKey = (PrivateKey)((PrivateApiKey)apiKey).getKey();
    	if (privateKey == null) {
    		throw new IllegalArgumentException("apiKey needs to contain a valid private key");
    	}
    	
    	if (log.isTraceEnabled()) {
			log.trace(MessageFormat.format("Timestamp: {0}", new Object[] { timeStamp }));
		}
    	
    	JWSPayload jwsPayload = new JWSPayload(apiKey.getId(), nonce, dateStamp, timeStamp, signedHeadersString, canonicalRequestHashHex, null);
    	
        String stringToSign = null;
		try {
			stringToSign = (new ObjectMapper()).writeValueAsString(jwsPayload);
		} catch (JsonProcessingException e1) {
			log.error("Failed to serialize the jws token", e1);
			throw new RequestAuthenticationException("Failed to serialize the jws token", e1);
		}

        if (log.isDebugEnabled()) {
        	log.debug("String to Sign: " + stringToSign);
        }
        
        JWSSigner signer = new RSASSASigner(privateKey);
        JWSObject jwsObject = new JWSObject(new JWSHeader(currentAlgorithm), new Payload(stringToSign));
        try {
			jwsObject.sign(signer);
		} catch (JOSEException e) {
			log.error("Failed to sign the jws token", e);
			throw new RequestAuthenticationException("Failed to sign the jws token", e);
		}

        String jwsString = jwsObject.serialize();
        
        String authorizationHeader = AUTHENTICATION_SCHEME + " " + createNameValuePair(JWS, jwsString);
        log.debug("AUTHORIZATION HEADER is " + authorizationHeader);    
        return authorizationHeader;
    	
    }
    
	protected JWSAlgorithm getCurrentAlgorithm() {
		return currentAlgorithm;
	}

	protected void setCurrentAlgorithm(JWSAlgorithm currentAlgorithm) {
		this.currentAlgorithm = currentAlgorithm;
	}
}