Examples with JwtValidator com.google.crypto.tink.jwt.JwtValidator used on opensource projects

Example 1 with JwtValidator

use of com.google.crypto.tink.jwt.JwtValidator in project tink by google.

the class JwtServiceImpl method convertProtoValidatorToValidator.

private JwtValidator convertProtoValidatorToValidator(com.google.crypto.tink.proto.testing.JwtValidator validator) throws JwtInvalidException {
    JwtValidator.Builder validatorBuilder = JwtValidator.newBuilder();
    if (validator.hasExpectedTypeHeader()) {
        validatorBuilder.expectTypeHeader(validator.getExpectedTypeHeader().getValue());
    }
    if (validator.hasExpectedIssuer()) {
        validatorBuilder.expectIssuer(validator.getExpectedIssuer().getValue());
    }
    if (validator.hasExpectedAudience()) {
        validatorBuilder.expectAudience(validator.getExpectedAudience().getValue());
    }
    if (validator.getIgnoreTypeHeader()) {
        validatorBuilder.ignoreTypeHeader();
    }
    if (validator.getIgnoreIssuer()) {
        validatorBuilder.ignoreIssuer();
    }
    if (validator.getIgnoreAudience()) {
        validatorBuilder.ignoreAudiences();
    }
    if (validator.getAllowMissingExpiration()) {
        validatorBuilder.allowMissingExpiration();
    }
    if (validator.getExpectIssuedInThePast()) {
        validatorBuilder.expectIssuedInThePast();
    }
    if (validator.hasNow()) {
        Instant now = timestampToInstant(validator.getNow());
        validatorBuilder.setClock(Clock.fixed(now, ZoneOffset.UTC));
    }
    if (validator.hasClockSkew()) {
        validatorBuilder.setClockSkew(Duration.ofSeconds(validator.getClockSkew().getSeconds()));
    }
    return validatorBuilder.build();
}

Example 2 with JwtValidator

use of com.google.crypto.tink.jwt.JwtValidator in project tink by google.

the class JwtServiceImpl method publicKeyVerifyAndDecode.

/**
 * Decodes and verifies a signed, compact JWT.
 */
@Override
public void publicKeyVerifyAndDecode(JwtVerifyRequest request, StreamObserver<JwtVerifyResponse> responseObserver) {
    JwtVerifyResponse response;
    try {
        KeysetHandle keysetHandle = CleartextKeysetHandle.read(BinaryKeysetReader.withBytes(request.getKeyset().toByteArray()));
        JwtValidator validator = convertProtoValidatorToValidator(request.getValidator());
        JwtPublicKeyVerify verifier = keysetHandle.getPrimitive(JwtPublicKeyVerify.class);
        VerifiedJwt verifiedJwt = verifier.verifyAndDecode(request.getSignedCompactJwt(), validator);
        JwtToken token = convertVerifiedJwtToJwtToken(verifiedJwt);
        response = JwtVerifyResponse.newBuilder().setVerifiedJwt(token).build();
    } catch (GeneralSecurityException | InvalidProtocolBufferException e) {
        response = JwtVerifyResponse.newBuilder().setErr(e.toString()).build();
    } catch (IOException e) {
        responseObserver.onError(Status.UNKNOWN.withDescription(e.getMessage()).asException());
        return;
    }
    responseObserver.onNext(response);
    responseObserver.onCompleted();
}

Example 3 with JwtValidator

use of com.google.crypto.tink.jwt.JwtValidator in project tink by google.

the class JwtServiceImpl method verifyMacAndDecode.

/**
 * Decodes and verifies a signed, compact JWT.
 */
@Override
public void verifyMacAndDecode(JwtVerifyRequest request, StreamObserver<JwtVerifyResponse> responseObserver) {
    JwtVerifyResponse response;
    try {
        KeysetHandle keysetHandle = CleartextKeysetHandle.read(BinaryKeysetReader.withBytes(request.getKeyset().toByteArray()));
        JwtValidator validator = convertProtoValidatorToValidator(request.getValidator());
        JwtMac jwtMac = keysetHandle.getPrimitive(JwtMac.class);
        VerifiedJwt verifiedJwt = jwtMac.verifyMacAndDecode(request.getSignedCompactJwt(), validator);
        JwtToken token = convertVerifiedJwtToJwtToken(verifiedJwt);
        response = JwtVerifyResponse.newBuilder().setVerifiedJwt(token).build();
    } catch (GeneralSecurityException | InvalidProtocolBufferException e) {
        response = JwtVerifyResponse.newBuilder().setErr(e.toString()).build();
    } catch (IOException e) {
        responseObserver.onError(Status.UNKNOWN.withDescription(e.getMessage()).asException());
        return;
    }
    responseObserver.onNext(response);
    responseObserver.onCompleted();
}

Example 4 with JwtValidator

use of com.google.crypto.tink.jwt.JwtValidator in project tink by google.

the class JwtVerify method main.

public static void main(String[] args) throws Exception {
    if (args.length != 3) {
        System.err.printf("Expected 3 parameters, got %d\n", args.length);
        System.err.println("Usage: java JwtVerify public-jwk-set-file audience token-file");
        System.exit(1);
    }
    File publicJwkSetFile = new File(args[0]);
    String audience = args[1];
    File tokenFile = new File(args[2]);
    // Register all JWT signature key types with the Tink runtime.
    JwtSignatureConfig.register();
    // Read the public keyset in JWK set format into a KeysetHandle.
    KeysetHandle publicKeysetHandle = null;
    try {
        String publicJwkSet = new String(Files.readAllBytes(publicJwkSetFile.toPath()), UTF_8);
        publicKeysetHandle = JwkSetConverter.toKeysetHandle(publicJwkSet, KeyAccess.publicAccess());
    } catch (GeneralSecurityException | IOException ex) {
        System.err.println("Cannot read keyset, got error: " + ex);
        System.exit(1);
    }
    List<String> lines = Files.readAllLines(tokenFile.toPath());
    if (lines.size() != 1) {
        System.err.printf("The signature file should contain only one line,  got %d", lines.size());
        System.exit(1);
    }
    String signedToken = lines.get(0).trim();
    // Get the primitive.
    JwtPublicKeyVerify verifier = null;
    try {
        verifier = publicKeysetHandle.getPrimitive(JwtPublicKeyVerify.class);
    } catch (GeneralSecurityException ex) {
        System.err.println("Cannot create primitive, got error: " + ex);
        System.exit(1);
    }
    // Use the primitive to verify a token.
    try {
        JwtValidator validator = JwtValidator.newBuilder().expectAudience(audience).build();
        VerifiedJwt verifiedJwt = verifier.verifyAndDecode(signedToken, validator);
        long seconds = ChronoUnit.SECONDS.between(Instant.now(), verifiedJwt.getExpiration());
        System.out.println("Token is valid and expires in " + seconds + " seconds.");
    } catch (GeneralSecurityException ex) {
        System.err.println("JWT verification failed.");
        System.exit(1);
    }
    System.exit(0);
}