com.atlassian.asap.core.validator

Class JwtValidatorImpl

java.lang.Object

com.atlassian.asap.core.validator.JwtValidatorImpl

All Implemented Interfaces:

JwtValidator

public class JwtValidatorImpl
extends Object
implements JwtValidator

Orchestrates the parsing of the JWT using the provided JwtParser, the verification of its signature using the provided KeyProvider and the validation of its claims using the provided JwtClaimsValidator.

Constructor Summary

Constructors

Constructor and Description
JwtValidatorImpl(KeyProvider<PublicKey> publicKeyProvider, JwtParser jwtParser, JwtClaimsValidator claimValidator, Set<String> resourceServerAudiences) Create a new instance of JwtValidatorImpl.
JwtValidatorImpl(KeyProvider<PublicKey> publicKeyProvider, JwtParser jwtParser, JwtClaimsValidator claimValidator, String resourceServerAudience) Create a new instance of JwtValidatorImpl.
JwtValidatorImpl(KeyProvider<PublicKey> publicKeyProvider, JwtParser jwtParser, JwtClaimsValidator claimValidator, Supplier<Set<String>> resourceServerAudiences) Create a new instance of JwtValidatorImpl.

Method Summary

Modifier and Type	Method and Description
static JwtValidator	createDefault(AuthenticationContext authenticationContext) A factory method that returns an instance with a typical configuration.
static JwtValidator	createDefault(Set<String> audiences, String publicKeyRepoBaseUrl) A factory method that returns an instance with a typical configuration.
static JwtValidator	createDefault(String audience, String publicKeyRepoBaseUrl) A factory method that returns an instance with a typical configuration.
Optional<String>	determineUnverifiedIssuer(String serializedJwt) Extracts the issuer, if at all possible, from the claims section by parsing the given serialized JWT.
Jwt	readAndValidate(String serializedJwt) Parses the encoded JWT message from String, verifies its signature, validates its claims and on success returns the decoded Jwt.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

JwtValidatorImpl

public JwtValidatorImpl(KeyProvider<PublicKey> publicKeyProvider,
                        JwtParser jwtParser,
                        JwtClaimsValidator claimValidator,
                        Supplier<Set<String>> resourceServerAudiences)

Create a new instance of JwtValidatorImpl.

Parameters:

publicKeyProvider - the key provider to use for retrieving public keys for signature verification

jwtParser - the parser to use for parsing a serialized jwt string

claimValidator - the validator to use for verifying the claims set contained in a JWT

resourceServerAudiences - all JWT messages will need to have one of these audiences to be valid. the supplier is called every time a JWT token is validated

JwtValidatorImpl

public JwtValidatorImpl(KeyProvider<PublicKey> publicKeyProvider,
                        JwtParser jwtParser,
                        JwtClaimsValidator claimValidator,
                        Set<String> resourceServerAudiences)

Create a new instance of JwtValidatorImpl.

Parameters:

publicKeyProvider - the key provider to use for retrieving public keys for signature verification

jwtParser - the parser to use for parsing a serialized jwt string

claimValidator - the validator to use for verifying the claims set contained in a JWT

resourceServerAudiences - all JWT messages will need to have one of these audiences to be valid

JwtValidatorImpl

public JwtValidatorImpl(KeyProvider<PublicKey> publicKeyProvider,
                        JwtParser jwtParser,
                        JwtClaimsValidator claimValidator,
                        String resourceServerAudience)

Create a new instance of JwtValidatorImpl.

Parameters:

publicKeyProvider - the key provider to use for retrieving public keys for signature verification

jwtParser - the parser to use for parsing a serialized jwt string

claimValidator - the validator to use for verifying the claims set contained in a JWT

resourceServerAudience - all JWT messages will need to have this audience to be valid

Method Detail

readAndValidate

public final Jwt readAndValidate(String serializedJwt)
                          throws InvalidTokenException,
                                 CannotRetrieveKeyException

Description copied from interface: JwtValidator

Parses the encoded JWT message from String, verifies its signature, validates its claims and on success returns the decoded Jwt.

Specified by:

readAndValidate in interface JwtValidator

Parameters:

serializedJwt - a JSON Web Token

Returns:

a signature verified and syntactically valid Jwt

Throws:

InvalidTokenException - if the JWT string was malformed (see subclasses)

CannotRetrieveKeyException - if the public key to verify the signature of the JWT can't be retrieved

determineUnverifiedIssuer

public final Optional<String> determineUnverifiedIssuer(String serializedJwt)

Description copied from interface: JwtValidator

Extracts the issuer, if at all possible, from the claims section by parsing the given serialized JWT. This will NOT validate anything in the JWT, and is only intended to be used to assist in returning useful authentication failure messages to clients, not for real issuer validation.

Specified by:

determineUnverifiedIssuer in interface JwtValidator

Parameters:

serializedJwt - a JSON Web Token

Returns:

the issuer claim from that JWT, or else empty if none could be parsed or found

createDefault

public static JwtValidator createDefault(AuthenticationContext authenticationContext)

A factory method that returns an instance with a typical configuration.

Parameters:

authenticationContext - context of the authentication

Returns:

a request authenticator for the given context

createDefault

public static JwtValidator createDefault(String audience,
                                         String publicKeyRepoBaseUrl)

A factory method that returns an instance with a typical configuration.

Parameters:

audience - the audience this filter will accept requests for

publicKeyRepoBaseUrl - the base URL of the public key repository

Returns:

a web filter

createDefault

public static JwtValidator createDefault(Set<String> audiences,
                                         String publicKeyRepoBaseUrl)

A factory method that returns an instance with a typical configuration.

Parameters:

audiences - the audiences this filter will accept requests for

publicKeyRepoBaseUrl - the base URL of the public key repository

Returns:

a web filter