Many resources are needed to download a project. Please understand that we have to compensate our server costs. Thank you in advance. Project price only 1 $
You can buy this project and download/modify it how often you want.
/*
* Licensed to The Apereo Foundation under one or more contributor license
* agreements. See the NOTICE file distributed with this work for additional
* information regarding copyright ownership.
*
*
* The Apereo Foundation licenses this file to you under the Educational
* Community License, Version 2.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of the License
* at:
*
* http://opensource.org/licenses/ecl2.txt
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
* License for the specific language governing permissions and limitations under
* the License.
*
*/
package org.opencastproject.security.jwt;
import com.auth0.jwk.JwkException;
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTVerificationException;
import com.auth0.jwt.interfaces.DecodedJWT;
import org.apache.commons.lang3.StringUtils;
import org.springframework.expression.EvaluationException;
import org.springframework.expression.Expression;
import org.springframework.expression.ExpressionParser;
import org.springframework.expression.ParseException;
import org.springframework.expression.spel.standard.SpelExpressionParser;
import org.springframework.util.Assert;
import java.util.List;
/**
* Helper class to verify JWTs.
*/
public final class JWTVerifier {
private JWTVerifier() { }
/**
* Verifies a given JWT string with a given JWK provider and given claim constraints.
*
* @param token The JWT string.
* @param provider The JWK provider.
* @param claimConstraints The claim constraints.
* @return The decoded and verified JWT.
* @throws JwkException If the JWT cannot be verified successfully.
*/
public static DecodedJWT verify(String token, GuavaCachedUrlJwkProvider provider, List claimConstraints)
throws JwkException {
Assert.notNull(token, "A token must be set");
Assert.notNull(provider, "A JWKS provider must be set");
DecodedJWT jwt = JWT.decode(token);
// First try with cache...
List algorithms = provider.getAlgorithms(jwt, false);
try {
return verify(jwt, claimConstraints, algorithms);
} catch (JWTVerificationException e) {
// ...then try again with forced fetch
// (recommended by e.g. https://openid.net/specs/openid-connect-core-1_0.html#RotateSigKeys)
algorithms = provider.getAlgorithms(jwt, true);
return verify(jwt, claimConstraints, algorithms);
}
}
/**
* Verifies a given JWT string with a secret and given claim constraints.
*
* @param token The JWT string.
* @param secret The secret.
* @param claimConstraints The claim constraints.
* @return The decoded and verified JWT.
* @throws JWTVerificationException If the JWT cannot be verified successfully.
*/
public static DecodedJWT verify(String token, String secret, List claimConstraints)
throws JWTVerificationException {
Assert.notNull(token, "A token must be set");
Assert.isTrue(StringUtils.isNotBlank(secret), "A secret must be set");
DecodedJWT jwt = JWT.decode(token);
return verify(jwt, claimConstraints, AlgorithmBuilder.buildAlgorithm(jwt, secret));
}
/**
* Verifies a given decoded JWT with the given claim constraints and algorithms. The verification has to be
* successful with at least one provided algorithm. Otherwise a {@link JWTVerificationException} is thrown.
*
* @param jwt The decoded JWT.
* @param claimConstraints The claim constraints.
* @param algorithms The algorithms.
* @return The decoded and verified JWT.
* @throws JWTVerificationException If the JWT cannot be verified successfully.
*/
public static DecodedJWT verify(DecodedJWT jwt, List claimConstraints, List algorithms)
throws JWTVerificationException {
return verify(jwt, claimConstraints, algorithms.toArray(new Algorithm[0]));
}
/**
* Verifies a given decoded JWT with the given claim constraints and algorithms. The verification has to be
* successful with at least one provided algorithm. Otherwise a {@link JWTVerificationException} is thrown.
*
* @param jwt The decoded JWT.
* @param claimConstraints The claim constraints.
* @param algorithms The algorithms.
* @return The decoded and verified JWT.
* @throws JWTVerificationException If the JWT cannot be verified successfully.
*/
public static DecodedJWT verify(DecodedJWT jwt, List claimConstraints, Algorithm... algorithms)
throws JWTVerificationException {
Assert.notNull(jwt, "A decoded JWT must be set");
Assert.notEmpty(claimConstraints, "Claim constraints must be set");
Assert.notEmpty(algorithms, "Algorithms must be set");
Assert.isTrue(algorithmsMatch(algorithms), "Algorithms must be of same class");
boolean verified = false;
Exception lastException = new JWTVerificationException("JWT could not be verified");
for (Algorithm algorithm : algorithms) {
try {
// General verification
JWT.require(algorithm).build().verify(jwt);
// Claim constraints verification
ExpressionParser parser = new SpelExpressionParser();
for (String constraint : claimConstraints) {
Expression exp = parser.parseExpression(constraint);
if (!exp.getValue(jwt.getClaims(), Boolean.class)) {
throw new JWTVerificationException("The claims did not fulfill constraint '" + constraint + "'");
}
}
// Verification was successful if no exception has been thrown
verified = true;
break;
} catch (JWTVerificationException | EvaluationException | ParseException e) {
// Ignore for now and try next algorithm
lastException = e;
}
}
// If verification was not successful until here, throw last known exception
if (!verified) {
throw new JWTVerificationException(lastException.getMessage());
}
return jwt;
}
/**
* Checks if the given array of algorithms match.
*
* @param algorithms The algorithms.
* @return true if all algorithms match, false otherwise.
*/
private static boolean algorithmsMatch(Algorithm... algorithms) {
for (int i = 1; i < algorithms.length; i++) {
if (!algorithms[i].getClass().equals(algorithms[0].getClass())) {
return false;
}
}
return true;
}
}