org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider クラス

org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider の継承関係図

org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider 連携図

公開メンバ関数
Authentication	authenticate (Authentication authentication) throws AuthenticationException
boolean	supports (Class<?> authentication)

非公開変数類
ClientKeyCacheService	validators
int	timeSkewAllowance = 300
ClientDetailsEntityService	clientService
ConfigurationPropertiesBean	config

静的非公開変数類
static final Logger	logger = LoggerFactory.getLogger(JWTBearerAuthenticationProvider.class)
static final GrantedAuthority	ROLE_CLIENT = new SimpleGrantedAuthority("ROLE_CLIENT")

詳解

著者

jricher

関数詳解

authenticate()

Authentication org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider.authenticate ( Authentication  authentication ) throws AuthenticationException

inline

Try to validate the client credentials by parsing and validating the JWT.

                                                                                                         {

                JWTBearerAssertionAuthenticationToken jwtAuth = (JWTBearerAssertionAuthenticationToken)authentication;


                try {
                        ClientDetailsEntity client = clientService.loadClientByClientId(jwtAuth.getName());

                        JWT jwt = jwtAuth.getJwt();
                        JWTClaimsSet jwtClaims = jwt.getJWTClaimsSet();

                        // check the signature with nimbus
                        if (jwt instanceof SignedJWT) {
                                SignedJWT jws = (SignedJWT)jwt;

                                JWSAlgorithm alg = jws.getHeader().getAlgorithm();

                                if (client.getTokenEndpointAuthSigningAlg() != null &&
                                                !client.getTokenEndpointAuthSigningAlg().equals(alg)) {
                                        throw new InvalidClientException("Client's registered request object signing algorithm (" + client.getRequestObjectSigningAlg() + ") does not match request object's actual algorithm (" + alg.getName() + ")");
                                }

                                if (client.getTokenEndpointAuthMethod() == null ||
                                                client.getTokenEndpointAuthMethod().equals(AuthMethod.NONE) ||
                                                client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_BASIC) ||
                                                client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_POST)) {

                                        // this client doesn't support this type of authentication
                                        throw new AuthenticationServiceException("Client does not support this authentication method.");

                                } else if ((client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY) &&
                                                (alg.equals(JWSAlgorithm.RS256)
                                                                || alg.equals(JWSAlgorithm.RS384)
                                                                || alg.equals(JWSAlgorithm.RS512)
                                                                || alg.equals(JWSAlgorithm.ES256)
                                                                || alg.equals(JWSAlgorithm.ES384)
                                                                || alg.equals(JWSAlgorithm.ES512)
                                                                || alg.equals(JWSAlgorithm.PS256)
                                                                || alg.equals(JWSAlgorithm.PS384)
                                                                || alg.equals(JWSAlgorithm.PS512)))
                                                || (client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_JWT) &&
                                                                (alg.equals(JWSAlgorithm.HS256)
                                                                                || alg.equals(JWSAlgorithm.HS384)
                                                                                || alg.equals(JWSAlgorithm.HS512)))) {

                                        // double-check the method is asymmetrical if we're in HEART mode
                                        if (config.isHeartMode() && !client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY)) {
                                                throw new AuthenticationServiceException("[HEART mode] Invalid authentication method");
                                        }

                                        JWTSigningAndValidationService validator = validators.getValidator(client, alg);

                                        if (validator == null) {
                                                throw new AuthenticationServiceException("Unable to create signature validator for client " + client + " and algorithm " + alg);
                                        }

                                        if (!validator.validateSignature(jws)) {
                                                throw new AuthenticationServiceException("Signature did not validate for presented JWT authentication.");
                                        }
                                } else {
                                        throw new AuthenticationServiceException("Unable to create signature validator for method " + client.getTokenEndpointAuthMethod() + " and algorithm " + alg);
                                }
                        }

                        // check the issuer
                        if (jwtClaims.getIssuer() == null) {
                                throw new AuthenticationServiceException("Assertion Token Issuer is null");
                        } else if (!jwtClaims.getIssuer().equals(client.getClientId())){
                                throw new AuthenticationServiceException("Issuers do not match, expected " + client.getClientId() + " got " + jwtClaims.getIssuer());
                        }

                        // check expiration
                        if (jwtClaims.getExpirationTime() == null) {
                                throw new AuthenticationServiceException("Assertion Token does not have required expiration claim");
                        } else {
                                // it's not null, see if it's expired
                                Date now = new Date(System.currentTimeMillis() - (timeSkewAllowance * 1000));
                                if (now.after(jwtClaims.getExpirationTime())) {
                                        throw new AuthenticationServiceException("Assertion Token is expired: " + jwtClaims.getExpirationTime());
                                }
                        }

                        // check not before
                        if (jwtClaims.getNotBeforeTime() != null) {
                                Date now = new Date(System.currentTimeMillis() + (timeSkewAllowance * 1000));
                                if (now.before(jwtClaims.getNotBeforeTime())){
                                        throw new AuthenticationServiceException("Assertion Token not valid untill: " + jwtClaims.getNotBeforeTime());
                                }
                        }

                        // check issued at
                        if (jwtClaims.getIssueTime() != null) {
                                // since it's not null, see if it was issued in the future
                                Date now = new Date(System.currentTimeMillis() + (timeSkewAllowance * 1000));
                                if (now.before(jwtClaims.getIssueTime())) {
                                        throw new AuthenticationServiceException("Assertion Token was issued in the future: " + jwtClaims.getIssueTime());
                                }
                        }

                        // check audience
                        if (jwtClaims.getAudience() == null) {
                                throw new AuthenticationServiceException("Assertion token audience is null");
                        } else if (!(jwtClaims.getAudience().contains(config.getIssuer()) || jwtClaims.getAudience().contains(config.getIssuer() + "token"))) {
                                throw new AuthenticationServiceException("Audience does not match, expected " + config.getIssuer() + " or " + (config.getIssuer() + "token") + " got " + jwtClaims.getAudience());
                        }

                        // IFF we managed to get all the way down here, the token is valid

                        // add in the ROLE_CLIENT authority
                        Set<GrantedAuthority> authorities = new HashSet<>(client.getAuthorities());
                        authorities.add(ROLE_CLIENT);

                        return new JWTBearerAssertionAuthenticationToken(jwt, authorities);

                } catch (InvalidClientException e) {
                        throw new UsernameNotFoundException("Could not find client: " + jwtAuth.getName());
                } catch (ParseException e) {

                        logger.error("Failure during authentication, error was: ", e);

                        throw new AuthenticationServiceException("Invalid JWT format");
                }
        }

supports()

boolean org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider.supports ( Class<?>  authentication )

inline

We support JWTBearerAssertionAuthenticationTokens only.

                                                         {
                return (JWTBearerAssertionAuthenticationToken.class.isAssignableFrom(authentication));
        }

メンバ詳解

clientService

ClientDetailsEntityService org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider.clientService

private

config

ConfigurationPropertiesBean org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider.config

private

logger

final Logger org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider.logger = LoggerFactory.getLogger(JWTBearerAuthenticationProvider.class)

staticprivate

Logger for this class

ROLE_CLIENT

final GrantedAuthority org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider.ROLE_CLIENT = new SimpleGrantedAuthority("ROLE_CLIENT")

staticprivate

timeSkewAllowance

int org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider.timeSkewAllowance = 300

private

validators

ClientKeyCacheService org.mitre.openid.connect.assertion.JWTBearerAuthenticationProvider.validators

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/mitreid-connect/src/openid-connect-server/src/main/java/org/mitre/openid/connect/assertion/JWTBearerAuthenticationProvider.java