Examples with JWSVerifier com.nimbusds.jose.JWSVerifier used on opensource projects

Example 36 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project hadoop by apache.

the class JWTRedirectAuthenticationHandler method validateSignature.

/**
 * Verify the signature of the JWT token in this method. This method depends
 * on the public key that was established during init based upon the
 * provisioned public key. Override this method in subclasses in order to
 * customize the signature verification behavior.
 *
 * @param jwtToken the token that contains the signature to be validated
 * @return valid true if signature verifies successfully; false otherwise
 */
protected boolean validateSignature(SignedJWT jwtToken) {
    boolean valid = false;
    if (JWSObject.State.SIGNED == jwtToken.getState()) {
        LOG.debug("JWT token is in a SIGNED state");
        if (jwtToken.getSignature() != null) {
            LOG.debug("JWT token signature is not null");
            try {
                JWSVerifier verifier = new RSASSAVerifier(publicKey);
                if (jwtToken.verify(verifier)) {
                    valid = true;
                    LOG.debug("JWT token has been successfully verified");
                } else {
                    LOG.warn("JWT signature verification failed.");
                }
            } catch (JOSEException je) {
                LOG.warn("Error while validating signature", je);
            }
        }
    }
    return valid;
}

Example 37 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project jans by JanssenProject.

the class JwtCrossCheckTest method validate.

private static void validate(String jwtAsString, AuthCryptoProvider cryptoProvider, String kid, SignatureAlgorithm signatureAlgorithm) throws Exception {
    SignedJWT signedJWT = SignedJWT.parse(jwtAsString);
    Jwt jwt = Jwt.parse(jwtAsString);
    JWSVerifier nimbusVerifier = null;
    AbstractJwsSigner oxauthVerifier = null;
    switch(signatureAlgorithm.getFamily()) {
        case EC:
            final ECKey ecKey = ECKey.load(cryptoProvider.getKeyStore(), kid, cryptoProvider.getKeyStoreSecret().toCharArray());
            final ECPublicKey ecPublicKey = ecKey.toECPublicKey();
            nimbusVerifier = new ECDSAVerifier(ecKey);
            oxauthVerifier = new ECDSASigner(jwt.getHeader().getSignatureAlgorithm(), new ECDSAPublicKey(jwt.getHeader().getSignatureAlgorithm(), ecPublicKey.getW().getAffineX(), ecPublicKey.getW().getAffineY()));
            break;
        case RSA:
            RSAKey rsaKey = RSAKey.load(cryptoProvider.getKeyStore(), kid, cryptoProvider.getKeyStoreSecret().toCharArray());
            final java.security.interfaces.RSAPublicKey rsaPublicKey = rsaKey.toRSAPublicKey();
            nimbusVerifier = new RSASSAVerifier(rsaKey);
            oxauthVerifier = new RSASigner(signatureAlgorithm, new RSAPublicKey(rsaPublicKey.getModulus(), rsaPublicKey.getPublicExponent()));
            break;
    }
    assertNotNull(nimbusVerifier);
    assertNotNull(oxauthVerifier);
    // Nimbus
    assertTrue(signedJWT.verify(nimbusVerifier));
    // oxauth cryptoProvider
    boolean validJwt = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), kid, null, null, jwt.getHeader().getSignatureAlgorithm());
    assertTrue(validJwt);
    // oxauth verifier
    assertTrue(oxauthVerifier.validate(jwt));
}

Example 38 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project athenz by AthenZ.

the class ZMSImplTest method getDomainData.

private DomainData getDomainData(JWSDomain jwsDomain) throws ParseException, JOSEException, JsonProcessingException {
    assertNotNull(jwsDomain);
    JWSObject jwsObject = new JWSObject(Base64URL.from(jwsDomain.getProtectedHeader()), Base64URL.from(jwsDomain.getPayload()), Base64URL.from(jwsDomain.getSignature()));
    JWSVerifier verifier = new RSASSAVerifier((RSAPublicKey) Crypto.extractPublicKey(zmsTestInitializer.getZms().privateKey.getKey()));
    assertTrue(jwsObject.verify(verifier));
    return zmsTestInitializer.getZms().jsonMapper.readValue(jwsObject.getPayload().toString(), DomainData.class);
}

Example 39 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project athenz by AthenZ.

the class ZTSImplTest method testPostSignedPolicyRequest.

@Test
public void testPostSignedPolicyRequest() throws ParseException, JOSEException {
    ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0");
    DataStore store = new DataStore(structStore, null, ztsMetric);
    ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store);
    ZTSImpl.serverHostName = "localhost";
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true);
    store.processSignedDomain(signedDomain, false);
    Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null);
    ResourceContext context = createResourceContext(principal);
    SignedPolicyRequest signedPolicyRequest = new SignedPolicyRequest();
    signedPolicyRequest.setPolicyVersions(Collections.emptyMap());
    Response response = ztsImpl.postSignedPolicyRequest(context, "coretech", signedPolicyRequest, null);
    assertEquals(response.getStatus(), 200);
    JWSPolicyData jwsPolicyData = (JWSPolicyData) response.getEntity();
    JWSObject jwsObject = new JWSObject(Base64URL.from(jwsPolicyData.getProtectedHeader()), Base64URL.from(jwsPolicyData.getPayload()), Base64URL.from(jwsPolicyData.getSignature()));
    JWSVerifier verifier = new RSASSAVerifier((RSAPublicKey) Crypto.extractPublicKey(zts.privateKey.getKey()));
    assertTrue(jwsObject.verify(verifier));
    // verify that with p1363 signature and rsa - it's the same key so validation is successful
    signedPolicyRequest.setSignatureP1363Format(true);
    response = ztsImpl.postSignedPolicyRequest(context, "coretech", signedPolicyRequest, null);
    assertEquals(response.getStatus(), 200);
    jwsPolicyData = (JWSPolicyData) response.getEntity();
    jwsObject = new JWSObject(Base64URL.from(jwsPolicyData.getProtectedHeader()), Base64URL.from(jwsPolicyData.getPayload()), Base64URL.from(jwsPolicyData.getSignature()));
    assertTrue(jwsObject.verify(verifier));
    try {
        ztsImpl.postSignedPolicyRequest(context, "unknowndomain", signedPolicyRequest, null);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 404);
    }
}

Example 40 with JWSVerifier

use of com.nimbusds.jose.JWSVerifier in project Insights by CognizantOneDevOps.

the class TokenProviderUtility method verifyExternalTokenAndFetchClaims.

/**
 * Used to verify received token without cache
 *
 * @param token
 * @return
 * @throws AuthorizationServiceException
 * @throws AuthenticationCredentialsNotFoundException
 * @throws AccountExpiredException
 * @throws InsightsCustomException
 */
public JWTClaimsSet verifyExternalTokenAndFetchClaims(String token) throws InsightsCustomException {
    boolean isVerify = Boolean.FALSE;
    boolean validateTokenDate = Boolean.FALSE;
    JWTClaimsSet claims = null;
    log.debug(" In verifyExternalTokenAndFetchClaims method ==== ");
    try {
        String authToken = ValidationUtils.cleanXSS(token);
        if (authToken == null || authToken.isEmpty()) {
            log.error("External authToken is not valid or empty");
            throw new InsightsCustomException("Invalid External authToken or empty authToken");
        }
        // parse the JWS and verify its HMAC
        SignedJWT signedJWT = SignedJWT.parse(authToken);
        JWSVerifier verifier = new MACVerifier(signingKey);
        isVerify = signedJWT.verify(verifier);
        claims = signedJWT.getJWTClaimsSet();
        // signedJWT.getJWTClaimsSet().getClaims().forEach((k,v) -> log.debug(" k ======== {} v ======== {} ",k,v));
        validateTokenDate = new Date().before(signedJWT.getJWTClaimsSet().getExpirationTime());
        if (!isVerify) {
            log.error("External Token signuture not match ");
            throw new AuthorizationServiceException("External Token signuture not match");
        } else if (!validateTokenDate) {
            throw new AccountExpiredException("External token validity Expire");
        } else {
            log.debug("External Token verified sucessfully ==== ");
        }
    } catch (Exception e) {
        log.error(e);
        log.error(" Exception while validating External token {} ", e.getMessage());
        throw new InsightsCustomException("Exception while varifing External token ==== " + e.getMessage());
    }
    return claims;
}