001package com.nimbusds.jwt; 002 003 004import java.text.ParseException; 005import java.util.*; 006 007import net.minidev.json.JSONArray; 008import net.minidev.json.JSONObject; 009 010import com.nimbusds.jose.util.JSONObjectUtils; 011 012 013/** 014 * JSON Web Token (JWT) claims set. 015 * 016 * <p>Supports all {@link #getRegisteredNames()} registered claims} of the JWT 017 * specification: 018 * 019 * <ul> 020 * <li>iss - Issuer 021 * <li>sub - Subject 022 * <li>aud - Audience 023 * <li>exp - Expiration Time 024 * <li>nbf - Not Before 025 * <li>iat - Issued At 026 * <li>jti - JWT ID 027 * <li>typ - Type 028 * </ul> 029 * 030 * <p>The set may also contain {@link #setCustomClaims custom claims}; these 031 * will be serialised and parsed along the registered ones. 032 * 033 * @author Vladimir Dzhuvinov 034 * @author Justin Richer 035 * @version $version$ (2014-08-16) 036 */ 037public class JWTClaimsSet implements ReadOnlyJWTClaimsSet { 038 039 040 private static final String TYPE_CLAIM = "typ"; 041 private static final String JWT_ID_CLAIM = "jti"; 042 private static final String ISSUED_AT_CLAIM = "iat"; 043 private static final String NOT_BEFORE_CLAIM = "nbf"; 044 private static final String EXPIRATION_TIME_CLAIM = "exp"; 045 private static final String AUDIENCE_CLAIM = "aud"; 046 private static final String SUBJECT_CLAIM = "sub"; 047 private static final String ISSUER_CLAIM = "iss"; 048 049 050 /** 051 * The registered claim names. 052 */ 053 private static final Set<String> REGISTERED_CLAIM_NAMES; 054 055 056 /** 057 * Initialises the registered claim name set. 058 */ 059 static { 060 Set<String> n = new HashSet<>(); 061 062 n.add(ISSUER_CLAIM); 063 n.add(SUBJECT_CLAIM); 064 n.add(AUDIENCE_CLAIM); 065 n.add(EXPIRATION_TIME_CLAIM); 066 n.add(NOT_BEFORE_CLAIM); 067 n.add(ISSUED_AT_CLAIM); 068 n.add(JWT_ID_CLAIM); 069 n.add(TYPE_CLAIM); 070 071 REGISTERED_CLAIM_NAMES = Collections.unmodifiableSet(n); 072 } 073 074 075 /** 076 * The issuer claim. 077 */ 078 private String iss = null; 079 080 081 /** 082 * The subject claim. 083 */ 084 private String sub = null; 085 086 087 /** 088 * The audience claim. 089 */ 090 private List<String> aud = null; 091 092 093 /** 094 * The expiration time claim. 095 */ 096 private Date exp = null; 097 098 099 /** 100 * The not-before claim. 101 */ 102 private Date nbf = null; 103 104 105 /** 106 * The issued-at claim. 107 */ 108 private Date iat = null; 109 110 111 /** 112 * The JWT ID claim. 113 */ 114 private String jti = null; 115 116 117 /** 118 * The type claim. 119 */ 120 private String typ = null; 121 122 123 /** 124 * Custom claims. 125 */ 126 private Map<String,Object> customClaims = new HashMap<>(); 127 128 129 /** 130 * Creates a new empty JWT claims set. 131 */ 132 public JWTClaimsSet() { 133 134 // Nothing to do 135 } 136 137 138 /** 139 * Creates a copy of the specified JWT claims set. 140 * 141 * @param old The JWT claims set to copy. Must not be {@code null}. 142 */ 143 public JWTClaimsSet(final ReadOnlyJWTClaimsSet old) { 144 145 super(); 146 setAllClaims(old.getAllClaims()); 147 } 148 149 150 /** 151 * Gets the registered JWT claim names. 152 * 153 * @return The registered claim names, as a unmodifiable set. 154 */ 155 public static Set<String> getRegisteredNames() { 156 157 return REGISTERED_CLAIM_NAMES; 158 } 159 160 161 @Override 162 public String getIssuer() { 163 164 return iss; 165 } 166 167 168 /** 169 * Sets the issuer ({@code iss}) claim. 170 * 171 * @param iss The issuer claim, {@code null} if not specified. 172 */ 173 public void setIssuer(final String iss) { 174 175 this.iss = iss; 176 } 177 178 179 @Override 180 public String getSubject() { 181 182 return sub; 183 } 184 185 186 /** 187 * Sets the subject ({@code sub}) claim. 188 * 189 * @param sub The subject claim, {@code null} if not specified. 190 */ 191 public void setSubject(final String sub) { 192 193 this.sub = sub; 194 } 195 196 197 @Override 198 public List<String> getAudience() { 199 200 return aud; 201 } 202 203 204 /** 205 * Sets the audience ({@code aud}) claim. 206 * 207 * @param aud The audience claim, {@code null} if not specified. 208 */ 209 public void setAudience(final List<String> aud) { 210 211 this.aud = aud; 212 } 213 214 215 /** 216 * Sets a single-valued audience ({@code aud}) claim. 217 * 218 * @param aud The audience claim, {@code null} if not specified. 219 */ 220 public void setAudience(final String aud) { 221 222 if (aud == null) { 223 this.aud = null; 224 } else { 225 this.aud = Arrays.asList(aud); 226 } 227 } 228 229 230 @Override 231 public Date getExpirationTime() { 232 233 return exp; 234 } 235 236 237 /** 238 * Sets the expiration time ({@code exp}) claim. 239 * 240 * @param exp The expiration time, {@code null} if not specified. 241 */ 242 public void setExpirationTime(final Date exp) { 243 244 this.exp = exp; 245 } 246 247 248 @Override 249 public Date getNotBeforeTime() { 250 251 return nbf; 252 } 253 254 255 /** 256 * Sets the not-before ({@code nbf}) claim. 257 * 258 * @param nbf The not-before claim, {@code null} if not specified. 259 */ 260 public void setNotBeforeTime(final Date nbf) { 261 262 this.nbf = nbf; 263 } 264 265 266 @Override 267 public Date getIssueTime() { 268 269 return iat; 270 } 271 272 273 /** 274 * Sets the issued-at ({@code iat}) claim. 275 * 276 * @param iat The issued-at claim, {@code null} if not specified. 277 */ 278 public void setIssueTime(final Date iat) { 279 280 this.iat = iat; 281 } 282 283 284 @Override 285 public String getJWTID() { 286 287 return jti; 288 } 289 290 291 /** 292 * Sets the JWT ID ({@code jti}) claim. 293 * 294 * @param jti The JWT ID claim, {@code null} if not specified. 295 */ 296 public void setJWTID(final String jti) { 297 298 this.jti = jti; 299 } 300 301 302 @Override 303 public String getType() { 304 305 return typ; 306 } 307 308 309 /** 310 * Sets the type ({@code typ}) claim. 311 * 312 * @param typ The type claim, {@code null} if not specified. 313 */ 314 public void setType(final String typ) { 315 316 this.typ = typ; 317 } 318 319 320 @Override 321 public Object getCustomClaim(final String name) { 322 323 return customClaims.get(name); 324 } 325 326 327 /** 328 * Sets a custom (non-registered) claim. 329 * 330 * @param name The name of the custom claim. Must not be {@code null}. 331 * @param value The value of the custom claim, should map to a valid 332 * JSON entity, {@code null} if not specified. 333 * 334 * @throws IllegalArgumentException If the specified custom claim name 335 * matches a registered claim name. 336 */ 337 public void setCustomClaim(final String name, final Object value) { 338 339 if (getRegisteredNames().contains(name)) { 340 341 throw new IllegalArgumentException("The claim name \"" + name + "\" matches a registered name"); 342 } 343 344 customClaims.put(name, value); 345 } 346 347 348 @Override 349 public Map<String,Object> getCustomClaims() { 350 351 return Collections.unmodifiableMap(customClaims); 352 } 353 354 355 /** 356 * Sets the custom (non-registered) claims. If a claim value doesn't 357 * map to a JSON entity it will be ignored during serialisation. 358 * 359 * @param customClaims The custom claims, empty map or {@code null} if 360 * none. 361 */ 362 public void setCustomClaims(final Map<String,Object> customClaims) { 363 364 if (customClaims == null) { 365 this.customClaims.clear(); 366 } else { 367 this.customClaims = customClaims; 368 } 369 } 370 371 372 @Override 373 public Object getClaim(final String name) { 374 375 if(ISSUER_CLAIM.equals(name)) { 376 return getIssuer(); 377 } else if(SUBJECT_CLAIM.equals(name)) { 378 return getSubject(); 379 } else if(AUDIENCE_CLAIM.equals(name)) { 380 return getAudience(); 381 } else if(EXPIRATION_TIME_CLAIM.equals(name)) { 382 return getExpirationTime(); 383 } else if(NOT_BEFORE_CLAIM.equals(name)) { 384 return getNotBeforeTime(); 385 } else if(ISSUED_AT_CLAIM.equals(name)) { 386 return getIssueTime(); 387 } else if(JWT_ID_CLAIM.equals(name)) { 388 return getJWTID(); 389 } else if(TYPE_CLAIM.equals(name)) { 390 return getType(); 391 } else { 392 return getCustomClaim(name); 393 } 394 } 395 396 397 @Override 398 public String getStringClaim(final String name) 399 throws ParseException { 400 401 Object value = getClaim(name); 402 403 if (value == null || value instanceof String) { 404 return (String)value; 405 } else { 406 throw new ParseException("The \"" + name + "\" claim is not a String", 0); 407 } 408 } 409 410 411 @Override 412 public Boolean getBooleanClaim(final String name) 413 throws ParseException { 414 415 Object value = getClaim(name); 416 417 if (value == null || value instanceof Boolean) { 418 return (Boolean)value; 419 } else { 420 throw new ParseException("The \"" + name + "\" claim is not a Boolean", 0); 421 } 422 } 423 424 425 @Override 426 public Integer getIntegerClaim(final String name) 427 throws ParseException { 428 429 Object value = getClaim(name); 430 431 if (value == null) { 432 return null; 433 } else if (value instanceof Number) { 434 return ((Number)value).intValue(); 435 } else { 436 throw new ParseException("The \"" + name + "\" claim is not an Integer", 0); 437 } 438 } 439 440 441 @Override 442 public Long getLongClaim(final String name) 443 throws ParseException { 444 445 Object value = getClaim(name); 446 447 if (value == null) { 448 return null; 449 } else if (value instanceof Number) { 450 return ((Number)value).longValue(); 451 } else { 452 throw new ParseException("The \"" + name + "\" claim is not a Number", 0); 453 } 454 } 455 456 457 @Override 458 public Float getFloatClaim(final String name) 459 throws ParseException { 460 461 Object value = getClaim(name); 462 463 if (value == null) { 464 return null; 465 } else if (value instanceof Number) { 466 return ((Number)value).floatValue(); 467 } else { 468 throw new ParseException("The \"" + name + "\" claim is not a Float", 0); 469 } 470 } 471 472 473 @Override 474 public Double getDoubleClaim(final String name) 475 throws ParseException { 476 477 Object value = getClaim(name); 478 479 if (value == null) { 480 return null; 481 } else if (value instanceof Number) { 482 return ((Number)value).doubleValue(); 483 } else { 484 throw new ParseException("The \"" + name + "\" claim is not a Double", 0); 485 } 486 } 487 488 489 /** 490 * Sets the specified claim, whether registered or custom. 491 * 492 * @param name The name of the claim to set. Must not be {@code null}. 493 * @param value The value of the claim to set, {@code null} if not 494 * specified. 495 * 496 * @throws IllegalArgumentException If the claim is registered and its 497 * value is not of the expected type. 498 */ 499 public void setClaim(final String name, final Object value) { 500 501 if (ISSUER_CLAIM.equals(name)) { 502 if (value == null || value instanceof String) { 503 setIssuer((String) value); 504 } else { 505 throw new IllegalArgumentException("Issuer claim must be a String"); 506 } 507 } else if (SUBJECT_CLAIM.equals(name)) { 508 if (value == null || value instanceof String) { 509 setSubject((String) value); 510 } else { 511 throw new IllegalArgumentException("Subject claim must be a String"); 512 } 513 } else if (AUDIENCE_CLAIM.equals(name)) { 514 if (value == null || value instanceof List<?>) { 515 setAudience((List<String>) value); 516 } else { 517 throw new IllegalArgumentException("Audience claim must be a List<String>"); 518 } 519 } else if (EXPIRATION_TIME_CLAIM.equals(name)) { 520 if (value == null || value instanceof Date) { 521 setExpirationTime((Date) value); 522 } else { 523 throw new IllegalArgumentException("Expiration claim must be a Date"); 524 } 525 } else if (NOT_BEFORE_CLAIM.equals(name)) { 526 if (value == null || value instanceof Date) { 527 setNotBeforeTime((Date) value); 528 } else { 529 throw new IllegalArgumentException("Not-before claim must be a Date"); 530 } 531 } else if (ISSUED_AT_CLAIM.equals(name)) { 532 if (value == null || value instanceof Date) { 533 setIssueTime((Date) value); 534 } else { 535 throw new IllegalArgumentException("Issued-at claim must be a Date"); 536 } 537 } else if (JWT_ID_CLAIM.equals(name)) { 538 if (value == null || value instanceof String) { 539 setJWTID((String) value); 540 } else { 541 throw new IllegalArgumentException("JWT-ID claim must be a String"); 542 } 543 } else if (TYPE_CLAIM.equals(name)) { 544 if (value == null || value instanceof String) { 545 setType((String) value); 546 } else { 547 throw new IllegalArgumentException("Type claim must be a String"); 548 } 549 } else { 550 setCustomClaim(name, value); 551 } 552 } 553 554 555 @Override 556 public Map<String,Object> getAllClaims() { 557 558 Map<String, Object> allClaims = new HashMap<>(); 559 560 allClaims.putAll(customClaims); 561 562 for (String registeredClaim : REGISTERED_CLAIM_NAMES) { 563 564 Object value = getClaim(registeredClaim); 565 566 if (value != null) { 567 allClaims.put(registeredClaim, value); 568 } 569 } 570 571 return Collections.unmodifiableMap(allClaims); 572 } 573 574 575 /** 576 * Sets the claims of this JWT claims set, replacing any existing ones. 577 * 578 * @param newClaims The JWT claims. Must not be {@code null}. 579 */ 580 public void setAllClaims(final Map<String, Object> newClaims) { 581 582 for (String name : newClaims.keySet()) { 583 setClaim(name, newClaims.get(name)); 584 } 585 } 586 587 588 @Override 589 public JSONObject toJSONObject() { 590 591 JSONObject o = new JSONObject(customClaims); 592 593 if (iss != null) { 594 o.put(ISSUER_CLAIM, iss); 595 } 596 597 if (sub != null) { 598 o.put(SUBJECT_CLAIM, sub); 599 } 600 601 if (aud != null && ! aud.isEmpty()) { 602 603 if (aud.size() == 1) { 604 o.put(AUDIENCE_CLAIM, aud.get(0)); 605 } else { 606 JSONArray audArray = new JSONArray(); 607 audArray.addAll(aud); 608 o.put(AUDIENCE_CLAIM, audArray); 609 } 610 } 611 612 if (exp != null) { 613 o.put(EXPIRATION_TIME_CLAIM, exp.getTime() / 1000); 614 } 615 616 if (nbf != null) { 617 o.put(NOT_BEFORE_CLAIM, nbf.getTime() / 1000); 618 } 619 620 if (iat != null) { 621 o.put(ISSUED_AT_CLAIM, iat.getTime() / 1000); 622 } 623 624 if (jti != null) { 625 o.put(JWT_ID_CLAIM, jti); 626 } 627 628 if (typ != null) { 629 o.put(TYPE_CLAIM, typ); 630 } 631 632 return o; 633 } 634 635 636 /** 637 * Parses a JSON Web Token (JWT) claims set from the specified JSON 638 * object representation. 639 * 640 * @param json The JSON object to parse. Must not be {@code null}. 641 * 642 * @return The JWT claims set. 643 * 644 * @throws ParseException If the specified JSON object doesn't 645 * represent a valid JWT claims set. 646 */ 647 public static JWTClaimsSet parse(final JSONObject json) 648 throws ParseException { 649 650 JWTClaimsSet cs = new JWTClaimsSet(); 651 652 // Parse registered + custom params 653 for (final String name: json.keySet()) { 654 655 if (name.equals(ISSUER_CLAIM)) { 656 657 cs.setIssuer(JSONObjectUtils.getString(json, ISSUER_CLAIM)); 658 659 } else if (name.equals(SUBJECT_CLAIM)) { 660 661 cs.setSubject(JSONObjectUtils.getString(json, SUBJECT_CLAIM)); 662 663 } else if (name.equals(AUDIENCE_CLAIM)) { 664 665 Object audValue = json.get(AUDIENCE_CLAIM); 666 667 if (audValue instanceof String) { 668 List<String> singleAud = new ArrayList<>(); 669 singleAud.add(JSONObjectUtils.getString(json, AUDIENCE_CLAIM)); 670 cs.setAudience(singleAud); 671 } else if (audValue instanceof List) { 672 cs.setAudience(JSONObjectUtils.getStringList(json, AUDIENCE_CLAIM)); 673 } 674 675 } else if (name.equals(EXPIRATION_TIME_CLAIM)) { 676 677 cs.setExpirationTime(new Date(JSONObjectUtils.getLong(json, EXPIRATION_TIME_CLAIM) * 1000)); 678 679 } else if (name.equals(NOT_BEFORE_CLAIM)) { 680 681 cs.setNotBeforeTime(new Date(JSONObjectUtils.getLong(json, NOT_BEFORE_CLAIM) * 1000)); 682 683 } else if (name.equals(ISSUED_AT_CLAIM)) { 684 685 cs.setIssueTime(new Date(JSONObjectUtils.getLong(json, ISSUED_AT_CLAIM) * 1000)); 686 687 } else if (name.equals(JWT_ID_CLAIM)) { 688 689 cs.setJWTID(JSONObjectUtils.getString(json, JWT_ID_CLAIM)); 690 691 } else if (name.equals(TYPE_CLAIM)) { 692 693 cs.setType(JSONObjectUtils.getString(json, TYPE_CLAIM)); 694 695 } else { 696 cs.setCustomClaim(name, json.get(name)); 697 } 698 } 699 700 return cs; 701 } 702 703 704 /** 705 * Parses a JSON Web Token (JWT) claims set from the specified JSON 706 * object string representation. 707 * 708 * @param s The JSON object string to parse. Must not be {@code null}. 709 * 710 * @return The JWT claims set. 711 * 712 * @throws ParseException If the specified JSON object string doesn't 713 * represent a valid JWT claims set. 714 */ 715 public static JWTClaimsSet parse(final String s) 716 throws ParseException { 717 718 return parse(JSONObjectUtils.parseJSONObject(s)); 719 } 720 721 @Override 722 public String toString() { 723 724 return "JWTClaimsSet [iss=" + iss + ", sub=" + sub + ", aud=" + aud + ", exp=" + exp + ", nbf=" + nbf + ", iat=" + iat + ", jti=" + jti + ", typ=" + typ + ", customClaims=" + customClaims + "]"; 725 } 726}