Examples with JWSVerifier com.nimbusds.jose.JWSVerifier used on opensource projects

Example 46 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project identity-inbound-auth-oauth by wso2-extensions.

the class OIDCLogoutServlet method validateIdToken.

/**
 * Validate Id token signature.
 *
 * @param idToken Id token
 * @return validation state
 */
private boolean validateIdToken(String idToken) {
    String tenantDomain = getTenantDomainForSignatureValidation(idToken);
    if (StringUtils.isEmpty(tenantDomain)) {
        return false;
    }
    int tenantId = IdentityTenantUtil.getTenantId(tenantDomain);
    RSAPublicKey publicKey;
    try {
        KeyStoreManager keyStoreManager = KeyStoreManager.getInstance(tenantId);
        if (!tenantDomain.equals(MultitenantConstants.SUPER_TENANT_DOMAIN_NAME)) {
            String ksName = tenantDomain.trim().replace(".", "-");
            String jksName = ksName + ".jks";
            publicKey = (RSAPublicKey) keyStoreManager.getKeyStore(jksName).getCertificate(tenantDomain).getPublicKey();
        } else {
            publicKey = (RSAPublicKey) keyStoreManager.getDefaultPublicKey();
        }
        SignedJWT signedJWT = SignedJWT.parse(idToken);
        JWSVerifier verifier = new RSASSAVerifier(publicKey);
        return signedJWT.verify(verifier);
    } catch (JOSEException | ParseException e) {
        if (log.isDebugEnabled()) {
            log.debug("Error occurred while validating id token signature for the id token: " + idToken);
        }
        return false;
    } catch (Exception e) {
        log.error("Error occurred while validating id token signature.");
        return false;
    }
}

Example 47 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project identity-inbound-auth-oauth by wso2-extensions.

the class DefaultLogoutTokenBuilder method validateIdTokenHint.

/**
 * Validate Id Token Hint.
 *
 * @param clientId
 * @param idToken
 * @return
 * @throws IdentityOAuth2Exception
 * @throws InvalidOAuthClientException
 */
private Boolean validateIdTokenHint(String clientId, String idToken) throws IdentityOAuth2Exception, InvalidOAuthClientException {
    String tenantDomain = getSigningTenantDomain(getOAuthAppDO(clientId));
    if (StringUtils.isEmpty(tenantDomain)) {
        return false;
    }
    int tenantId = IdentityTenantUtil.getTenantId(tenantDomain);
    RSAPublicKey publicKey;
    try {
        KeyStoreManager keyStoreManager = KeyStoreManager.getInstance(tenantId);
        if (!tenantDomain.equals(MultitenantConstants.SUPER_TENANT_DOMAIN_NAME)) {
            String ksName = tenantDomain.trim().replace(".", "-");
            String jksName = ksName + ".jks";
            publicKey = (RSAPublicKey) keyStoreManager.getKeyStore(jksName).getCertificate(tenantDomain).getPublicKey();
        } else {
            publicKey = (RSAPublicKey) keyStoreManager.getDefaultPublicKey();
        }
        SignedJWT signedJWT = SignedJWT.parse(idToken);
        JWSVerifier verifier = new RSASSAVerifier(publicKey);
        return signedJWT.verify(verifier);
    } catch (JOSEException | ParseException e) {
        if (log.isDebugEnabled()) {
            log.debug("Error occurred while validating id token signature.", e);
        }
        return false;
    } catch (Exception e) {
        log.error("Error occurred while validating id token signature.", e);
        return false;
    }
}

Example 48 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project identity-inbound-auth-oauth by wso2-extensions.

the class OAuth2Util method validateIdToken.

/**
 * Validate Id token signature
 *
 * @param idToken Id token
 * @return validation state
 */
public static boolean validateIdToken(String idToken) {
    boolean isJWTSignedWithSPKey = OAuthServerConfiguration.getInstance().isJWTSignedWithSPKey();
    String tenantDomain;
    try {
        String clientId = SignedJWT.parse(idToken).getJWTClaimsSet().getAudience().get(0);
        if (isJWTSignedWithSPKey) {
            OAuthAppDO oAuthAppDO = OAuth2Util.getAppInformationByClientId(clientId);
            tenantDomain = OAuth2Util.getTenantDomainOfOauthApp(oAuthAppDO);
        } else {
            // It is not sending tenant domain with the subject in id_token by default, So to work this as
            // expected, need to enable the option "Use tenant domain in local subject identifier" in SP config
            tenantDomain = MultitenantUtils.getTenantDomain(SignedJWT.parse(idToken).getJWTClaimsSet().getSubject());
        }
        if (StringUtils.isEmpty(tenantDomain)) {
            return false;
        }
        int tenantId = IdentityTenantUtil.getTenantId(tenantDomain);
        RSAPublicKey publicKey;
        KeyStoreManager keyStoreManager = KeyStoreManager.getInstance(tenantId);
        if (!tenantDomain.equals(org.wso2.carbon.base.MultitenantConstants.SUPER_TENANT_DOMAIN_NAME)) {
            String ksName = tenantDomain.trim().replace(".", "-");
            String jksName = ksName + ".jks";
            publicKey = (RSAPublicKey) keyStoreManager.getKeyStore(jksName).getCertificate(tenantDomain).getPublicKey();
        } else {
            publicKey = (RSAPublicKey) keyStoreManager.getDefaultPublicKey();
        }
        SignedJWT signedJWT = SignedJWT.parse(idToken);
        JWSVerifier verifier = new RSASSAVerifier(publicKey);
        return signedJWT.verify(verifier);
    } catch (JOSEException | ParseException e) {
        if (log.isDebugEnabled()) {
            log.debug("Error occurred while validating id token signature.");
        }
        return false;
    } catch (Exception e) {
        log.error("Error occurred while validating id token signature.");
        return false;
    }
}

Example 49 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project VulnerableApp by SasanLabs.

the class JWTValidator method jwkKeyHeaderPublicKeyTrustingVulnerableValidator.

@Override
public boolean jwkKeyHeaderPublicKeyTrustingVulnerableValidator(String token) throws ServiceApplicationException {
    try {
        String[] jwtParts = token.split(JWTUtils.JWT_TOKEN_PERIOD_CHARACTER_REGEX, -1);
        JSONObject header = new JSONObject(JWTUtils.getString(Base64.getUrlDecoder().decode(jwtParts[0].getBytes(StandardCharsets.UTF_8))));
        if (header.has(JWTUtils.JWT_ALGORITHM_KEY_HEADER)) {
            String alg = header.getString(JWTUtils.JWT_ALGORITHM_KEY_HEADER);
            if (!alg.startsWith(JWTUtils.JWT_HMAC_ALGORITHM_IDENTIFIER)) {
                JWSVerifier verifier = null;
                if (header.has(JWTUtils.JSON_WEB_KEY_HEADER)) {
                    if (alg.startsWith(JWTUtils.JWT_RSA_ALGORITHM_IDENTIFIER) || alg.startsWith(JWTUtils.JWT_RSA_PSS_ALGORITHM_IDENTIFIER)) {
                        RSAKey rsaKey = RSAKey.parse(header.getJSONObject(JWTUtils.JSON_WEB_KEY_HEADER).toString());
                        verifier = new RSASSAVerifier(rsaKey.toRSAPublicKey());
                    } else if (alg.startsWith(JWTUtils.JWT_EC_ALGORITHM_IDENTIFIER)) {
                        ECKey ecKey = ECKey.parse(header.getJSONObject(JWTUtils.JSON_WEB_KEY_HEADER).toString());
                        verifier = new ECDSAVerifier(ecKey.toECPublicKey());
                    } else if (alg.startsWith(JWTUtils.JWT_OCTET_ALGORITHM_IDENTIFIER)) {
                        verifier = new Ed25519Verifier(OctetKeyPair.parse(header.getString(JWTUtils.JSON_WEB_KEY_HEADER)));
                    }
                    SignedJWT signedJWT = SignedJWT.parse(token);
                    return signedJWT.verify(verifier);
                }
            }
        }
    } catch (UnsupportedEncodingException | ParseException | JOSEException ex) {
        throw new ServiceApplicationException("Following exception occurred: ", ex, ExceptionStatusCodeEnum.SYSTEM_ERROR);
    }
    return false;
}

Example 50 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project spid-cie-oidc-java by italia.

the class JWTHelper method verifyJWS.

public boolean verifyJWS(SignedJWT jws, JWKSet jwkSet) throws OIDCException {
    String kid = jws.getHeader().getKeyID();
    JWK jwk = jwkSet.getKeyByKeyId(kid);
    if (jwk == null) {
        throw new JWTException.UnknownKid(kid, jwkSet.toString());
    }
    JWSAlgorithm alg = jws.getHeader().getAlgorithm();
    if (!isValidAlgorithm(alg)) {
        throw new JWTException.UnsupportedAlgorithm(alg.toString());
    }
    try {
        JWSVerifier verifier = getJWSVerifier(alg, jwk);
        return jws.verify(verifier);
    } catch (Exception e) {
        throw new JWTException.Verifier(e);
    }
}