Module iu.util.crypt.impl

Package iu.crypt

Class Jwt

java.lang.Object

iu.crypt.Jwt

All Implemented Interfaces:

WebToken

Direct Known Subclasses:

SessionJwt

public class Jwt
extends Object
implements WebToken

Immutable WebToken with JWT signing, signature verification, and encryption methods.

Field Summary

Fields

Modifier and Type	Field	Description
protected final JsonObject	claims	Parsed JWT claims
protected static final IuJsonAdapter<Instant>	NUMERIC_DATE	Translates Instant values as seconds since epoch

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	Jwt(JsonObject claims)	JSON claims constructor

Method Summary

Modifier and Type	Method	Description
static JsonObject	decryptAndVerify(String jwt, WebKey issuerKey, WebKey audienceKey)	Parses, decrypts, and verifies a JWT encoded with JWS compact serialization.
boolean	equals(Object obj)
Iterable<URI>	getAudience()	Gets the token audience URIs.
Instant	getExpires()	Gets the time after which the JWT should not be accepted.
Instant	getIssuedAt()	Gets the time the JWT was issued.
URI	getIssuer()	Gets the token issuer URI.
String	getNonce()	Gets the nonce claim.
Instant	getNotBefore()	Gets the time before which the JWT should not be accepted.
String	getSubject()	Gets the subject of the JWT.
String	getTokenId()	Gets the token identifier.
int	hashCode()
boolean	isExpired()	Determines if the token has expired.
String	sign(String type, WebKey.Algorithm algorithm, WebKey issuerKey)	Signs this Jwt
String	signAndEncrypt(String type, WebKey.Algorithm signAlgorithm, WebKey issuerKey, WebKey.Algorithm encryptAlgorithm, WebEncryption.Encryption encryption, WebKey audienceKey)	Signs and encrypts this Jwt
String	toString()
protected void	validate()	Performs basic JWT validation logic.
void	validateClaims(URI expectedAudience, Duration ttl)	Verify JWT registered claims are well-formed and within the allowed time window.
static JsonObject	verify(String jwt, WebKey issuerKey)	Parses and verifies a JWT encoded with JWS compact serialization.

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Details

NUMERIC_DATE

protected static final IuJsonAdapter<Instant> NUMERIC_DATE

Translates Instant values as seconds since epoch

claims

protected final JsonObject claims

Parsed JWT claims

Constructor Details

Jwt

protected Jwt(JsonObject claims)

JSON claims constructor

Parameters:

claims - JsonObject of token claims

Method Details

verify

public static JsonObject verify(String jwt,
 WebKey issuerKey)

Parses and verifies a JWT encoded with JWS compact serialization.

Parameters:

jwt - JWS compact serialization

issuerKey - Issuer public WebKey

Returns:

JsonObject of token claims

decryptAndVerify

public static JsonObject decryptAndVerify(String jwt,
 WebKey issuerKey,
 WebKey audienceKey)

Parses, decrypts, and verifies a JWT encoded with JWS compact serialization.

Parameters:

jwt - JWS or JWE compact serialization

issuerKey - Issuer public WebKey

audienceKey - Audience private WebKey, ignored if the JWT is not encrypted

Returns:

JsonObject of token claims

validate

protected void validate()

Performs basic JWT validation logic.

See Also:

• RFC-7519 JSON Web Token Section 4.1

validateClaims

public void validateClaims(URI expectedAudience,
 Duration ttl)

Description copied from interface: WebToken

Verify JWT registered claims are well-formed and within the allowed time window.

In addition to the rules outlined in RFC-7519 JWT Section 4.1, REQUIRES the following claim values to be present and not empty:

• WebToken.getIssuer()
• WebToken.getAudience()
• WebToken.getSubject()
• WebToken.getIssuedAt()
• WebToken.getExpires()

Specified by:

validateClaims in interface WebToken

Parameters:

expectedAudience - Expected audience URI

ttl - Maximum assertion time to live allowed by configuration

getTokenId

public String getTokenId()

Description copied from interface: WebToken

Gets the token identifier.

Specified by:

getTokenId in interface WebToken

Returns:

token identifier (jti claim);

getIssuer

public URI getIssuer()

Description copied from interface: WebToken

Gets the token issuer URI.

Specified by:

getIssuer in interface WebToken

Returns:

URI

getAudience

public Iterable<URI> getAudience()

Description copied from interface: WebToken

Gets the token audience URIs.

Specified by:

getAudience in interface WebToken

Returns:

at least one URI

getSubject

public String getSubject()

Description copied from interface: WebToken

Gets the subject of the JWT.

Specified by:

getSubject in interface WebToken

Returns:

subject (sub claim)

getIssuedAt

public Instant getIssuedAt()

Description copied from interface: WebToken

Gets the time the JWT was issued.

Specified by:

getIssuedAt in interface WebToken

Returns:

issued time (iat claim)

getNotBefore

public Instant getNotBefore()

Description copied from interface: WebToken

Gets the time before which the JWT should not be accepted.

Specified by:

getNotBefore in interface WebToken

Returns:

not before time (nbf claim)

getExpires

public Instant getExpires()

Description copied from interface: WebToken

Gets the time after which the JWT should not be accepted.

Specified by:

getExpires in interface WebToken

Returns:

token expiration time (exp claim)

getNonce

public String getNonce()

Description copied from interface: WebToken

Gets the nonce claim.

Specified by:

getNonce in interface WebToken

Returns:

nonce claim value

See Also:

• OpenID Connection Core 1.0 Section 15.5.2

isExpired

public boolean isExpired()

Description copied from interface: WebToken

Determines if the token has expired.

Specified by:

isExpired in interface WebToken

Returns:

true if WebToken.getExpires() is in the past

sign

public String sign(String type,
 WebKey.Algorithm algorithm,
 WebKey issuerKey)

Signs this Jwt

Specified by:

sign in interface WebToken

Parameters:

type - Token type

algorithm - WebKey.Algorithm

issuerKey - Issuer private WebKey

Returns:

JWS compact serialization

signAndEncrypt

public String signAndEncrypt(String type,
 WebKey.Algorithm signAlgorithm,
 WebKey issuerKey,
 WebKey.Algorithm encryptAlgorithm,
 WebEncryption.Encryption encryption,
 WebKey audienceKey)

Signs and encrypts this Jwt

Specified by:

signAndEncrypt in interface WebToken

Parameters:

type - Token type

signAlgorithm - WebKey.Algorithm

issuerKey - Issuer private WebKey

encryptAlgorithm - WebKey.Algorithm

encryption - WebEncryption.Encryption

audienceKey - Audience public WebKey

Returns:

JWE compact serialization

hashCode

public int hashCode()

Overrides:

hashCode in class Object

equals

public boolean equals(Object obj)

Overrides:

equals in class Object

toString

public String toString()

Overrides:

toString in class Object