com.google.api.client.googleapis.auth.oauth2
Class GoogleIdTokenVerifier

java.lang.Object
  com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier

public final class GoogleIdTokenVerifier
extends Object

Thread-safe Google ID token verifier.

The public keys are loaded Google's public certificate endpoint at "https://www.googleapis.com/oauth2/v1/certs". The public keys are cached in this instance of GoogleIdTokenVerifier. Therefore, for maximum efficiency, applications should use a single globally-shared instance of the GoogleIdTokenVerifier. Use verify(GoogleIdToken) or GoogleIdToken.verify(GoogleIdTokenVerifier) to verify a Google ID token.

Samples usage:

  public static GoogleIdTokenVerifier verifier;

  public static void initVerifier(
      HttpTransport transport, JsonFactory jsonFactory, String clientId) {
    verifier = new GoogleIdTokenVerifier(transport, jsonFactory, clientId);
  }

  public static boolean verifyToken(GoogleIdToken idToken)
      throws GeneralSecurityException, IOException {
    return verifier.verify(idToken);
  }
 

Since:

1.7

Constructor Summary

GoogleIdTokenVerifier(HttpTransport transport, JsonFactory jsonFactory, String clientId)
Constructor with required parameters.

Method Summary

String	getClientId() Returns the client ID or null for none.
long	getExpirationTimeMilliseconds() Returns the expiration time in milliseconds to be used with System.currentTimeMillis() or 0 for none.
JsonFactory	getJsonFactory() Returns the JSON factory.
List<PublicKey>	getPublicKeys() Returns the public keys or null for none.
GoogleIdTokenVerifier	loadPublicCerts() Downloads the public keys from the public certificates endpoint at "https://www.googleapis.com/oauth2/v1/certs".
boolean	verify(GoogleIdToken idToken) Verifies that the given ID token is valid using verify(GoogleIdToken, String) with the getClientId().
boolean	verify(GoogleIdToken idToken, String clientId) Verifies that the given ID token is valid, using the given client ID.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

GoogleIdTokenVerifier

public GoogleIdTokenVerifier(HttpTransport transport,
                             JsonFactory jsonFactory,
                             String clientId)

Constructor with required parameters.

Parameters:

transport - HTTP transport

jsonFactory - JSON factory

clientId - client ID or null for none

Method Detail

getJsonFactory

public JsonFactory getJsonFactory()

Returns the JSON factory.

getClientId

public String getClientId()

Returns the client ID or null for none.

getPublicKeys

public List<PublicKey> getPublicKeys()

Returns the public keys or null for none.

getExpirationTimeMilliseconds

public long getExpirationTimeMilliseconds()

Returns the expiration time in milliseconds to be used with System.currentTimeMillis() or 0 for none.

verify

public boolean verify(GoogleIdToken idToken)
               throws GeneralSecurityException,
                      IOException

Verifies that the given ID token is valid using verify(GoogleIdToken, String) with the getClientId().

Parameters:

idToken - Google ID token

Returns:

true if verified successfully or false if failed

Throws:

GeneralSecurityException

IOException

verify

public boolean verify(GoogleIdToken idToken,
                      String clientId)
               throws GeneralSecurityException,
                      IOException

Verifies that the given ID token is valid, using the given client ID. It verifies:

• The RS256 signature, which uses RSA and SHA-256 based on the public keys downloaded from the public certificate endpoint.
• The current time against the issued at and expiration time (allowing for a 5 minute clock skew).
• The issuer is "accounts.google.com".
• The audience and issuee match the client ID (skipped if clientId is null.

Parameters:

idToken - Google ID token

clientId - client ID or null to skip checking it

Returns:

true if verified successfully or false if failed

Throws:

GeneralSecurityException

IOException

Since:

1.8

loadPublicCerts

public GoogleIdTokenVerifier loadPublicCerts()
                                      throws GeneralSecurityException,
                                             IOException

Downloads the public keys from the public certificates endpoint at "https://www.googleapis.com/oauth2/v1/certs".

This method is automatically called if the public keys have not yet been initialized or if the expiration time is very close, so normally this doesn't need to be called. Only call this method explicitly to force the public keys to be updated.

Throws:

GeneralSecurityException

IOException