com.auth0.jwk.JwkProvider Java Examples

private static JWTVerifier createJWTVerifier(final JwkProvider jwkProvider) {
    Algorithm alg = Algorithm.RSA256(new RSAKeyProvider() {
        @Override
        public RSAPublicKey getPublicKeyById(String keyId) {
            try {
                Jwk jwk = jwkProvider.get(keyId);
                return (RSAPublicKey) jwk.getPublicKey();
            } catch (JwkException ignored) {
                // JwkException handled by Algorithm verify implementation from java-jwt
            }
            return null;
        }

        @Override
        public RSAPrivateKey getPrivateKey() {
            //NO-OP
            return null;
        }

        @Override
        public String getPrivateKeyId() {
            //NO-OP
            return null;
        }
    });
    return JWT.require(alg)
            .ignoreIssuedAt()
            .build();
}
 

@Test
public void failsWhenErrorGettingJwk() throws Exception {
    JwkProvider  jwkProvider = mock(JwkProvider.class);
    when(jwkProvider.get("abc123")).thenThrow(JwkException.class);

    exception.expect(TokenValidationException.class);
    exception.expectMessage("Invalid token signature");
    SignatureVerifier verifier = new AsymmetricSignatureVerifier(jwkProvider);
    verifier.verifySignature(RS_JWT);
}
 

private JwkProvider getRSProvider(String rsaPath) throws Exception {
    JwkProvider jwkProvider = mock(JwkProvider.class);
    Jwk jwk = mock(Jwk.class);
    when(jwkProvider.get("abc123")).thenReturn(jwk);
    RSAPublicKey key = readPublicKeyFromFile(rsaPath);
    when(jwk.getPublicKey()).thenReturn(key);
    return jwkProvider;
}
 

@Test
public void shouldCreateWithJwkProvider() {
    JwkProvider provider = mock(JwkProvider.class);
    AuthenticationController.newBuilder("domain", "clientId", "clientSecret")
            .withJwkProvider(provider)
            .build();
}
 

public static AuthenticationController getInstance(ServletConfig config) throws UnsupportedEncodingException {
    String domain = config.getServletContext().getInitParameter("com.auth0.domain");
    String clientId = config.getServletContext().getInitParameter("com.auth0.clientId");
    String clientSecret = config.getServletContext().getInitParameter("com.auth0.clientSecret");

    if (domain == null || clientId == null || clientSecret == null) {
        throw new IllegalArgumentException("Missing domain, clientId, or clientSecret. Did you update src/main/webapp/WEB-INF/web.xml?");
    }

    // JwkProvider required for RS256 tokens. If using HS256, do not use.
    JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
    return AuthenticationController.newBuilder(domain, clientId, clientSecret)
            .withJwkProvider(jwkProvider)
            .build();
}
 

@Bean
public AuthenticationController authenticationController() throws UnsupportedEncodingException {
    JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
    return AuthenticationController.newBuilder(domain, clientId, clientSecret)
            .withJwkProvider(jwkProvider)
            .build();
}
 

@Override
protected void configure() {

  bind(HttpJsonRequestFactory.class)
      .to(org.eclipse.che.multiuser.keycloak.server.KeycloakHttpJsonRequestFactory.class);
  bind(TokenValidator.class).to(KeycloakTokenValidator.class);
  bind(KeycloakConfigurationService.class);

  bind(ProfileDao.class).to(KeycloakProfileDao.class);
  bind(JwkProvider.class).toProvider(KeycloakJwkProvider.class);
  bind(JwtParser.class).toProvider(KeycloakJwtParserProvider.class);
  bind(PersonalAccountUserManager.class).to(KeycloakUserManager.class);

  bind(OAuthAPI.class).toProvider(OAuthAPIProvider.class);
}
 

@Bean
public AuthenticationController authenticationController() throws UnsupportedEncodingException {
    JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
    return AuthenticationController.newBuilder(domain, clientId, clientSecret)
        .withJwkProvider(jwkProvider)
        .build();
}
 

AsymmetricSignatureVerifier(JwkProvider jwkProvider) {
    super(createJWTVerifier(jwkProvider), "RS256");
}
 

@Test
public void shouldCreateWithAsymmetricSignatureVerifierWhenJwkProviderIsExplicitlySet() {
    JwkProvider jwkProvider = mock(JwkProvider.class);
    AuthenticationController controller = builderSpy
            .withResponseType("code id_token")
            .withJwkProvider(jwkProvider)
            .build();

    SignatureVerifier signatureVerifier = signatureVerifierCaptor.getValue();
    assertThat(signatureVerifier, is(notNullValue()));
    assertThat(signatureVerifier, instanceOf(AsymmetricSignatureVerifier.class));
    assertThat(verificationOptions, is(controller.getRequestProcessor().verifyOptions));

    controller = builderSpy
            .withResponseType("code token")
            .withJwkProvider(jwkProvider)
            .build();

    signatureVerifier = signatureVerifierCaptor.getValue();
    assertThat(signatureVerifier, is(notNullValue()));
    assertThat(signatureVerifier, instanceOf(AsymmetricSignatureVerifier.class));
    assertThat(verificationOptions, is(controller.getRequestProcessor().verifyOptions));

    controller = builderSpy
            .withResponseType("code id_token token")
            .withJwkProvider(jwkProvider)
            .build();

    signatureVerifier = signatureVerifierCaptor.getValue();
    assertThat(signatureVerifier, is(notNullValue()));
    assertThat(signatureVerifier, instanceOf(AsymmetricSignatureVerifier.class));
    assertThat(verificationOptions, is(controller.getRequestProcessor().verifyOptions));

    controller = builderSpy
            .withResponseType("code")
            .withJwkProvider(jwkProvider)
            .build();

    signatureVerifier = signatureVerifierCaptor.getValue();
    assertThat(signatureVerifier, is(notNullValue()));
    assertThat(signatureVerifier, instanceOf(AsymmetricSignatureVerifier.class));
    assertThat(verificationOptions, is(controller.getRequestProcessor().verifyOptions));

    controller = builderSpy
            .withResponseType("id_token")
            .withJwkProvider(jwkProvider)
            .build();

    signatureVerifier = signatureVerifierCaptor.getValue();
    assertThat(signatureVerifier, is(notNullValue()));
    assertThat(signatureVerifier, instanceOf(AsymmetricSignatureVerifier.class));
    assertThat(verificationOptions, is(controller.getRequestProcessor().verifyOptions));

    controller = builderSpy
            .withResponseType("token")
            .withJwkProvider(jwkProvider)
            .build();

    signatureVerifier = signatureVerifierCaptor.getValue();
    assertThat(signatureVerifier, is(notNullValue()));
    assertThat(signatureVerifier, instanceOf(AsymmetricSignatureVerifier.class));
    assertThat(verificationOptions, is(controller.getRequestProcessor().verifyOptions));
}
 

@Override
public JwkProvider get() {
  return jwkProvider;
}
 

@Inject
KeycloakSigningKeyResolver(JwkProvider jwkProvider) {
  this.jwkProvider = jwkProvider;
}
 

/**
 * Configures application authorization for JWT signed with RS256.
 * Will try to validate the token using the public key downloaded from "$issuer/.well-known/jwks.json"
 * and matched by the value of {@code kid} of the JWT header
 * @param audience identifier of the API and must match the {@code aud} value in the token
 * @param issuers array of allowed issuers of the token for this API and one of the entries must match the {@code iss} value in the token
 * @return JwtWebSecurityConfigurer for further configuration
 */
@SuppressWarnings({"WeakerAccess", "SameParameterValue"})
public static JwtWebSecurityConfigurer forRS256(String audience, String[] issuers) {
    final JwkProvider jwkProvider = new JwkProviderBuilder(issuers[0]).build(); // we use the first issuer for getting the jwkProvider
    return new JwtWebSecurityConfigurer(audience, issuers, new JwtAuthenticationProvider(jwkProvider, issuers, audience));
}
 

/**
 * Sets the Jwk Provider that will return the Public Key required to verify the token in case of Implicit Grant flows.
 * This is required if the Auth0 Application is signing the tokens with the RS256 algorithm.
 *
 * @param jwkProvider a valid Jwk provider.
 * @return this same builder instance.
 */
public Builder withJwkProvider(JwkProvider jwkProvider) {
    Validate.notNull(jwkProvider);
    this.jwkProvider = jwkProvider;
    return this;
}