Examples with SignRequest com.amazonaws.services.kms.model.SignRequest used on opensource projects

Example 6 with SignRequest

use of com.amazonaws.services.kms.model.SignRequest in project di-authentication-api by alphagov.

the class TokenService method generateSignedJWT.

public SignedJWT generateSignedJWT(JWTClaimsSet claimsSet, Optional<String> type) {
    var signingKeyId = kmsConnectionService.getPublicKey(new GetPublicKeyRequest().withKeyId(configService.getTokenSigningKeyAlias())).getKeyId();
    try {
        var jwsHeader = new JWSHeader.Builder(TOKEN_ALGORITHM).keyID(hashSha256String(signingKeyId));
        type.map(JOSEObjectType::new).ifPresent(jwsHeader::type);
        Base64URL encodedHeader = jwsHeader.build().toBase64URL();
        Base64URL encodedClaims = Base64URL.encode(claimsSet.toString());
        String message = encodedHeader + "." + encodedClaims;
        ByteBuffer messageToSign = ByteBuffer.wrap(message.getBytes());
        SignRequest signRequest = new SignRequest();
        signRequest.setMessage(messageToSign);
        signRequest.setKeyId(configService.getTokenSigningKeyAlias());
        signRequest.setSigningAlgorithm(SigningAlgorithmSpec.ECDSA_SHA_256.toString());
        SignResult signResult = kmsConnectionService.sign(signRequest);
        LOG.info("Token has been signed successfully");
        String signature = Base64URL.encode(ECDSA.transcodeSignatureToConcat(signResult.getSignature().array(), ECDSA.getSignatureByteArrayLength(TOKEN_ALGORITHM))).toString();
        return SignedJWT.parse(message + "." + signature);
    } catch (java.text.ParseException | JOSEException e) {
        LOG.error("Exception thrown when trying to parse SignedJWT or JWTClaimSet", e);
        throw new RuntimeException(e);
    }
}

Example 7 with SignRequest

use of com.amazonaws.services.kms.model.SignRequest in project di-authentication-api by alphagov.

the class AuditService method signPayload.

private byte[] signPayload(byte[] payload) {
    SignRequest signRequest = new SignRequest();
    signRequest.setKeyId(configurationService.getAuditSigningKeyAlias());
    signRequest.setMessage(ByteBuffer.wrap(payload));
    signRequest.setSigningAlgorithm(SigningAlgorithmSpec.ECDSA_SHA_256.toString());
    return kmsConnectionService.sign(signRequest).getSignature().array();
}

Example 8 with SignRequest

use of com.amazonaws.services.kms.model.SignRequest in project di-authentication-api by alphagov.

the class DocAppCriService method generatePrivateKeyJwt.

private PrivateKeyJWT generatePrivateKeyJwt(JWTAuthenticationClaimsSet claimsSet) {
    try {
        var jwsHeader = new JWSHeader.Builder(TOKEN_ALGORITHM).keyID(configurationService.getDocAppTokenSigningKeyAlias()).build();
        var encodedHeader = jwsHeader.toBase64URL();
        var encodedClaims = Base64URL.encode(claimsSet.toJWTClaimsSet().toString());
        var message = encodedHeader + "." + encodedClaims;
        var messageToSign = ByteBuffer.wrap(message.getBytes());
        var signRequest = new SignRequest();
        signRequest.setMessage(messageToSign);
        signRequest.setKeyId(configurationService.getDocAppTokenSigningKeyAlias());
        signRequest.setSigningAlgorithm(SigningAlgorithmSpec.ECDSA_SHA_256.toString());
        SignResult signResult = kmsService.sign(signRequest);
        LOG.info("PrivateKeyJWT has been signed successfully");
        var signature = Base64URL.encode(ECDSA.transcodeSignatureToConcat(signResult.getSignature().array(), ECDSA.getSignatureByteArrayLength(TOKEN_ALGORITHM))).toString();
        return new PrivateKeyJWT(SignedJWT.parse(message + "." + signature));
    } catch (JOSEException | java.text.ParseException e) {
        LOG.error("Exception thrown when trying to parse SignedJWT or JWTClaimSet", e);
        throw new RuntimeException(e);
    }
}

Example 9 with SignRequest

use of com.amazonaws.services.kms.model.SignRequest in project di-authentication-api by alphagov.

the class IPVTokenService method generatePrivateKeyJwt.

private PrivateKeyJWT generatePrivateKeyJwt(JWTAuthenticationClaimsSet claimsSet) {
    try {
        var jwsHeader = new JWSHeader.Builder(TOKEN_ALGORITHM).keyID(configurationService.getIPVTokenSigningKeyAlias()).build();
        var encodedHeader = jwsHeader.toBase64URL();
        var encodedClaims = Base64URL.encode(claimsSet.toJWTClaimsSet().toString());
        var message = encodedHeader + "." + encodedClaims;
        var messageToSign = ByteBuffer.wrap(message.getBytes());
        var signRequest = new SignRequest();
        signRequest.setMessage(messageToSign);
        signRequest.setKeyId(configurationService.getIPVTokenSigningKeyAlias());
        signRequest.setSigningAlgorithm(SigningAlgorithmSpec.ECDSA_SHA_256.toString());
        SignResult signResult = kmsService.sign(signRequest);
        LOG.info("PrivateKeyJWT has been signed successfully");
        var signature = Base64URL.encode(ECDSA.transcodeSignatureToConcat(signResult.getSignature().array(), ECDSA.getSignatureByteArrayLength(TOKEN_ALGORITHM))).toString();
        return new PrivateKeyJWT(SignedJWT.parse(message + "." + signature));
    } catch (JOSEException | java.text.ParseException e) {
        LOG.error("Exception thrown when trying to parse SignedJWT or JWTClaimSet", e);
        throw new RuntimeException(e);
    }
}