com.nimbusds.jwt.proc

Class DefaultJWTProcessor<C extends SecurityContext>

java.lang.Object

com.nimbusds.jose.proc.BaseJOSEProcessor<C>

com.nimbusds.jwt.proc.DefaultJWTProcessor<C>

All Implemented Interfaces:

JWTProcessor<ReadOnlyJWTClaimsSet,C>

public class DefaultJWTProcessor<C extends SecurityContext>
extends BaseJOSEProcessor<C>
implements JWTProcessor<ReadOnlyJWTClaimsSet,C>

Default processor of received JSON Web Tokens.

Must be supplied with a JWS key selector to determine the key candidate(s) for the signature verification. The exact key selection procedure is application-specific and may involve key ID lookup, a certificate check and / or other information supplied in the message context.

Similarly, the processor must be supplied with a JWE key selector if JWE messages are expected to be processed.

See sections 6 of RFC 7515 (JWS) and RFC 7516 (JWE) for guidelines on key selection.

This processor comes with the default JWS verifier factory and the default JWE decrypter factory; they can construct verifiers / decrypters for all standard JOSE algorithms implemented by the library.

Note that for security reasons this processor is hardwired to reject unsecured (plain) JWTs. Override the process(PlainJWT, SecurityContext) if you need to handle plain JWTs as well.

An optional JWT claims verifier may be set to perform various application-specific JWT claims checks, such as issuer acceptance, after successful JWS verification / JWE decryption.

To process generic JOSE objects (with arbitrary payloads) use the DefaultJOSEProcessor class.

Version:

2015-07-01

Author:

Vladimir Dzhuvinov

Constructor Summary

Constructors

Constructor and Description
DefaultJWTProcessor()

Method Summary

Methods

Modifier and Type	Method and Description
JWTClaimsVerifier	getJWTClaimsVerifier() Gets the optional JWT claims verifier.
ReadOnlyJWTClaimsSet	process(EncryptedJWT encryptedJWT, C context) Processes the specified encrypted JWT by decrypting it.
ReadOnlyJWTClaimsSet	process(JWT jwt, C context) Processes the specified JWT (unsecured, signed or encrypted).
ReadOnlyJWTClaimsSet	process(PlainJWT plainJWT, C context) Processes the specified unsecured (plain) JWT, typically by checking its context.
ReadOnlyJWTClaimsSet	process(SignedJWT signedJWT, C context) Processes the specified signed JWT by verifying its signature.
ReadOnlyJWTClaimsSet	process(String jwtString, C context) Parses and processes the specified JWT (unsecured, signed or encrypted).
void	setJWTClaimsVerifier(JWTClaimsVerifier claimsVerifier) Sets the optional JWT claims verifier.

Methods inherited from class com.nimbusds.jose.proc.BaseJOSEProcessor

getJWEDecrypterFactory, getJWEKeySelector, getJWSKeySelector, getJWSVerifierFactory, setJWEDecrypterFactory, setJWEKeySelector, setJWSKeySelector, setJWSVerifierFactory

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DefaultJWTProcessor

public DefaultJWTProcessor()

Method Detail

getJWTClaimsVerifier

public JWTClaimsVerifier getJWTClaimsVerifier()

Gets the optional JWT claims verifier. Intended to perform various application-specific JWT claims checks, such as issuer acceptance, after successful JWS verification / JWE decryption.

Returns:

The JWT claims verifier, null if not specified.

setJWTClaimsVerifier

public void setJWTClaimsVerifier(JWTClaimsVerifier claimsVerifier)

Sets the optional JWT claims verifier. Intended to perform various application-specific JWT claims checks, such as issuer acceptance, after successful JWS verification / JWE decryption.

Parameters:

claimsVerifier - The JWT claims verifier, null if not specified.

process

public ReadOnlyJWTClaimsSet process(String jwtString,
                           C context)
                             throws ParseException,
                                    BadJOSEException,
                                    JOSEException

Description copied from interface: JWTProcessor

Parses and processes the specified JWT (unsecured, signed or encrypted).

Specified by:

process in interface JWTProcessor<ReadOnlyJWTClaimsSet,C extends SecurityContext>

Parameters:

jwtString - The JWT, compact-encoded to a URL-safe string. Must not be null.

context - Optional context of the JOSE object, null if not required.

Returns:

An application-specific object (the JWT claims) on success, or null if no return value is necessary.

Throws:

ParseException - If the string couldn't be parsed to a valid JWT.

BadJOSEException - If the JWT is rejected.

JOSEException - If an internal processing exception is encountered.

process

public ReadOnlyJWTClaimsSet process(JWT jwt,
                           C context)
                             throws BadJOSEException,
                                    JOSEException

Description copied from interface: JWTProcessor

Processes the specified JWT (unsecured, signed or encrypted).

Specified by:

process in interface JWTProcessor<ReadOnlyJWTClaimsSet,C extends SecurityContext>

Parameters:

jwt - The JWT. Must not be null.

context - Optional context of the JOSE object, null if not required.

Returns:

An application-specific object (the JWT claims) on success, or null if no return value is necessary.

Throws:

BadJOSEException - If the JWT is rejected.

JOSEException - If an internal processing exception is encountered.

process

public ReadOnlyJWTClaimsSet process(PlainJWT plainJWT,
                           C context)
                             throws BadJOSEException,
                                    JOSEException

Description copied from interface: JWTProcessor

Processes the specified unsecured (plain) JWT, typically by checking its context.

Specified by:

process in interface JWTProcessor<ReadOnlyJWTClaimsSet,C extends SecurityContext>

Parameters:

plainJWT - The unsecured (plain) JWT. Not null.

context - Optional context of the unsecured JWT, null if not required.

Returns:

An application-specific object (the JWT claims) on success, or null if no return value is necessary.

Throws:

BadJOSEException - If the unsecured (plain) JWT is rejected, after examining the context or due to the payload not being a JSON object.

JOSEException - If an internal processing exception is encountered.

process

public ReadOnlyJWTClaimsSet process(SignedJWT signedJWT,
                           C context)
                             throws BadJOSEException,
                                    JOSEException

Description copied from interface: JWTProcessor

Processes the specified signed JWT by verifying its signature. The key candidate(s) are selected by examining the JWS header and / or the message context.

Specified by:

process in interface JWTProcessor<ReadOnlyJWTClaimsSet,C extends SecurityContext>

Parameters:

signedJWT - The signed JWT. Not null.

context - Optional context of the signed JWT, null if not required.

Returns:

An application-specific object (the JWT claims) on success, or null if no return value is necessary.

Throws:

BadJOSEException - If the signed JWT is rejected, typically due to a bad signature or the payload not being a JSON object.

JOSEException - If an internal processing exception is encountered.

process

public ReadOnlyJWTClaimsSet process(EncryptedJWT encryptedJWT,
                           C context)
                             throws BadJOSEException,
                                    JOSEException

Description copied from interface: JWTProcessor

Processes the specified encrypted JWT by decrypting it. The key candidate(s) are selected by examining the JWS header and / or the message context.

Specified by:

process in interface JWTProcessor<ReadOnlyJWTClaimsSet,C extends SecurityContext>

Parameters:

encryptedJWT - The encrypted JWT. Not null.

context - Optional context of the encrypted JWT, null if not required.

Returns:

An application-specific object (the JWT claims) on success, or null if no return value is necessary.

Throws:

BadJOSEException - If the encrypted JWT is rejected, typically due to failed decryption or the payload not being a JSON object.

JOSEException - If an internal processing exception is encountered.