Examples with SignedJwt org.forgerock.json.jose.jws.SignedJwt used on opensource projects

Example 11 with SignedJwt

use of org.forgerock.json.jose.jws.SignedJwt in project OpenAM by OpenRock.

the class EndSession method validateRedirect.

private void validateRedirect(OAuth2Request request, String idToken, String redirectUri) throws InvalidClientException, RedirectUriMismatchException, RelativeRedirectUriException, NotFoundException {
    SignedJwt jwt = new JwtReconstruction().reconstructJwt(idToken, SignedJwt.class);
    JwtClaimsSet claims = jwt.getClaimsSet();
    String clientId = (String) claims.getClaim(OAuth2Constants.JWTTokenParams.AZP);
    ClientRegistration client = clientRegistrationStore.get(clientId, request);
    URI requestedUri = URI.create(redirectUri);
    if (!requestedUri.isAbsolute()) {
        throw new RelativeRedirectUriException();
    }
    if (!client.getPostLogoutRedirectUris().contains(requestedUri)) {
        throw new RedirectUriMismatchException();
    }
}

Example 12 with SignedJwt

use of org.forgerock.json.jose.jws.SignedJwt in project OpenAM by OpenRock.

the class OpenIDTokenIssuer method issueToken.

/**
     * Issues an OpenId Connect token, using the details of the access token.
     *
     * @param accessToken The access token requested by the OAuth2 request.
     * @param request The OAuth2 request.
     * @return A {@code Map.Entry} of the token name with the Token instance.
     * @throws ServerException If any internal server error occurs.
     * @throws InvalidClientException If either the request does not contain the client's id or the client fails to be
     *          authenticated.
     * @throws NotFoundException If the realm does not have an OAuth 2.0 provider service.
     */
public Map.Entry<String, String> issueToken(AccessToken accessToken, OAuth2Request request) throws ServerException, InvalidClientException, NotFoundException {
    final Set<String> scope = accessToken.getScope();
    if (scope != null && scope.contains(OAuth2Constants.Params.OPENID)) {
        final ResourceOwner resourceOwner;
        try {
            request.setSession(accessToken.getSessionId());
            resourceOwner = resourceOwnerSessionValidator.validate(request);
            final String nonce = accessToken.getNonce();
            final OpenIdConnectToken openIdToken = tokenStore.createOpenIDToken(resourceOwner, accessToken.getClientId(), accessToken.getClientId(), nonce, getOps(accessToken, request), request);
            final SignedJwt signedJwt = openIdToken.sign();
            return new AbstractMap.SimpleEntry<String, String>(OAuth2Constants.JWTTokenParams.ID_TOKEN, signedJwt.build());
        } catch (SignatureException e) {
            logger.error("Unable to sign JWT", e);
            throw new ServerException("Cant sign JWT");
        } catch (OAuth2Exception e) {
            logger.error("User must be authenticated to issue ID tokens.", e);
            throw new ServerException("User must be authenticated to issue ID tokens.");
        }
    }
    return null;
}

Example 13 with SignedJwt

use of org.forgerock.json.jose.jws.SignedJwt in project OpenAM by OpenRock.

the class PolicyRequestTest method getJwtSubject.

private Jwt getJwtSubject(final String subjectName) {
    JwsHeader header = new JwsHeader(Collections.<String, Object>emptyMap());
    JwtClaimsSet claims = new JwtClaimsSet();
    claims.setSubject(subjectName);
    SigningHandler handler = new NOPSigningHandler();
    return new SignedJwt(header, claims, handler);
}

Example 14 with SignedJwt

use of org.forgerock.json.jose.jws.SignedJwt in project OpenAM by OpenRock.

the class CheckSessionImpl method getClientSessionURI.

/**
     * {@inheritDoc}
     */
public String getClientSessionURI(HttpServletRequest request) throws UnauthorizedClientException, InvalidClientException, NotFoundException {
    SignedJwt jwt = getIDToken(request);
    if (jwt == null) {
        return "";
    }
    final ClientRegistration clientRegistration = getClientRegistration(jwt);
    if (clientRegistration != null && !isJwtValid(jwt, clientRegistration)) {
        return "";
    }
    return clientRegistration.getClientSessionURI();
}

Example 15 with SignedJwt

use of org.forgerock.json.jose.jws.SignedJwt in project OpenAM by OpenRock.

the class CheckSessionImpl method getValidSession.

/**
     * {@inheritDoc}
     */
public boolean getValidSession(HttpServletRequest request) {
    SignedJwt jwt = getIDToken(request);
    if (jwt == null) {
        return false;
    }
    try {
        final ClientRegistration clientRegistration = getClientRegistration(jwt);
        if (clientRegistration != null && !isJwtValid(jwt, clientRegistration)) {
            return false;
        }
        String opsId = (String) jwt.getClaimsSet().getClaim(OPS);
        if (opsId == null) {
            opsId = (String) jwt.getClaimsSet().getClaim(LEGACY_OPS);
        }
        JsonValue idTokenUserSessionToken = tokenAdapter.fromToken(cts.read(opsId));
        String sessionId = idTokenUserSessionToken.get(LEGACY_OPS).asString();
        SSOToken ssoToken = ssoTokenManager.createSSOToken(sessionId);
        return ssoTokenManager.isValidToken(ssoToken);
    } catch (Exception e) {
        logger.error("Unable to get the SSO token", e);
        return false;
    }
}