Examples with JwtPublicKeyVerify com.google.crypto.tink.jwt.JwtPublicKeyVerify used on opensource projects

Example 1 with JwtPublicKeyVerify

use of com.google.crypto.tink.jwt.JwtPublicKeyVerify in project tink by google.

the class JwtServiceImpl method publicKeyVerifyAndDecode.

/**
 * Decodes and verifies a signed, compact JWT.
 */
@Override
public void publicKeyVerifyAndDecode(JwtVerifyRequest request, StreamObserver<JwtVerifyResponse> responseObserver) {
    JwtVerifyResponse response;
    try {
        KeysetHandle keysetHandle = CleartextKeysetHandle.read(BinaryKeysetReader.withBytes(request.getKeyset().toByteArray()));
        JwtValidator validator = convertProtoValidatorToValidator(request.getValidator());
        JwtPublicKeyVerify verifier = keysetHandle.getPrimitive(JwtPublicKeyVerify.class);
        VerifiedJwt verifiedJwt = verifier.verifyAndDecode(request.getSignedCompactJwt(), validator);
        JwtToken token = convertVerifiedJwtToJwtToken(verifiedJwt);
        response = JwtVerifyResponse.newBuilder().setVerifiedJwt(token).build();
    } catch (GeneralSecurityException | InvalidProtocolBufferException e) {
        response = JwtVerifyResponse.newBuilder().setErr(e.toString()).build();
    } catch (IOException e) {
        responseObserver.onError(Status.UNKNOWN.withDescription(e.getMessage()).asException());
        return;
    }
    responseObserver.onNext(response);
    responseObserver.onCompleted();
}

Example 2 with JwtPublicKeyVerify

use of com.google.crypto.tink.jwt.JwtPublicKeyVerify in project tink by google.

the class JwtVerify method main.

public static void main(String[] args) throws Exception {
    if (args.length != 3) {
        System.err.printf("Expected 3 parameters, got %d\n", args.length);
        System.err.println("Usage: java JwtVerify public-jwk-set-file audience token-file");
        System.exit(1);
    }
    File publicJwkSetFile = new File(args[0]);
    String audience = args[1];
    File tokenFile = new File(args[2]);
    // Register all JWT signature key types with the Tink runtime.
    JwtSignatureConfig.register();
    // Read the public keyset in JWK set format into a KeysetHandle.
    KeysetHandle publicKeysetHandle = null;
    try {
        String publicJwkSet = new String(Files.readAllBytes(publicJwkSetFile.toPath()), UTF_8);
        publicKeysetHandle = JwkSetConverter.toKeysetHandle(publicJwkSet, KeyAccess.publicAccess());
    } catch (GeneralSecurityException | IOException ex) {
        System.err.println("Cannot read keyset, got error: " + ex);
        System.exit(1);
    }
    List<String> lines = Files.readAllLines(tokenFile.toPath());
    if (lines.size() != 1) {
        System.err.printf("The signature file should contain only one line,  got %d", lines.size());
        System.exit(1);
    }
    String signedToken = lines.get(0).trim();
    // Get the primitive.
    JwtPublicKeyVerify verifier = null;
    try {
        verifier = publicKeysetHandle.getPrimitive(JwtPublicKeyVerify.class);
    } catch (GeneralSecurityException ex) {
        System.err.println("Cannot create primitive, got error: " + ex);
        System.exit(1);
    }
    // Use the primitive to verify a token.
    try {
        JwtValidator validator = JwtValidator.newBuilder().expectAudience(audience).build();
        VerifiedJwt verifiedJwt = verifier.verifyAndDecode(signedToken, validator);
        long seconds = ChronoUnit.SECONDS.between(Instant.now(), verifiedJwt.getExpiration());
        System.out.println("Token is valid and expires in " + seconds + " seconds.");
    } catch (GeneralSecurityException ex) {
        System.err.println("JWT verification failed.");
        System.exit(1);
    }
    System.exit(0);
}