001/* 002 * nimbus-jose-jwt 003 * 004 * Copyright 2012-2018, Connect2id Ltd. 005 * 006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use 007 * this file except in compliance with the License. You may obtain a copy of the 008 * License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software distributed 013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR 014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the 015 * specific language governing permissions and limitations under the License. 016 */ 017 018package com.nimbusds.jose.jwk; 019 020 021import java.io.File; 022import java.io.IOException; 023import java.io.InputStream; 024import java.net.URL; 025import java.nio.charset.Charset; 026import java.security.KeyStore; 027import java.security.KeyStoreException; 028import java.security.cert.Certificate; 029import java.security.interfaces.ECPublicKey; 030import java.security.interfaces.RSAPublicKey; 031import java.text.ParseException; 032import java.util.*; 033 034import com.nimbusds.jose.JOSEException; 035import com.nimbusds.jose.util.*; 036import net.jcip.annotations.Immutable; 037import net.minidev.json.JSONArray; 038import net.minidev.json.JSONObject; 039 040 041/** 042 * JSON Web Key (JWK) set. Represented by a JSON object that contains an array 043 * of {@link JWK JSON Web Keys} (JWKs) as the value of its "keys" member. 044 * Additional (custom) members of the JWK Set JSON object are also supported. 045 * 046 * <p>Example JSON Web Key (JWK) set: 047 * 048 * <pre> 049 * { 050 * "keys" : [ { "kty" : "EC", 051 * "crv" : "P-256", 052 * "x" : "MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4", 053 * "y" : "4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM", 054 * "use" : "enc", 055 * "kid" : "1" }, 056 * 057 * { "kty" : "RSA", 058 * "n" : "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx 059 * 4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMs 060 * tn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2 061 * QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbI 062 * SD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqb 063 * w0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw", 064 * "e" : "AQAB", 065 * "alg" : "RS256", 066 * "kid" : "2011-04-29" } ] 067 * } 068 * </pre> 069 * 070 * @author Vladimir Dzhuvinov 071 * @author Vedran Pavic 072 * @version 2018-04-26 073 */ 074@Immutable 075public class JWKSet { 076 077 078 /** 079 * The MIME type of JWK set objects: 080 * {@code application/jwk-set+json; charset=UTF-8} 081 */ 082 public static final String MIME_TYPE = "application/jwk-set+json; charset=UTF-8"; 083 084 085 /** 086 * The JWK list. 087 */ 088 private final List<JWK> keys; 089 090 091 /** 092 * Additional custom members. 093 */ 094 private final Map<String,Object> customMembers; 095 096 097 /** 098 * Creates a new empty JSON Web Key (JWK) set. 099 */ 100 public JWKSet() { 101 102 this(Collections.<JWK>emptyList()); 103 } 104 105 106 /** 107 * Creates a new JSON Web Key (JWK) set with a single key. 108 * 109 * @param key The JWK. Must not be {@code null}. 110 */ 111 public JWKSet(final JWK key) { 112 113 this(Collections.singletonList(key)); 114 115 if (key == null) { 116 throw new IllegalArgumentException("The JWK must not be null"); 117 } 118 } 119 120 121 /** 122 * Creates a new JSON Web Key (JWK) set with the specified keys. 123 * 124 * @param keys The JWK list. Must not be {@code null}. 125 */ 126 public JWKSet(final List<JWK> keys) { 127 128 this(keys, Collections.<String, Object>emptyMap()); 129 } 130 131 132 /** 133 * Creates a new JSON Web Key (JWK) set with the specified keys and 134 * additional custom members. 135 * 136 * @param keys The JWK list. Must not be {@code null}. 137 * @param customMembers The additional custom members. Must not be 138 * {@code null}. 139 */ 140 public JWKSet(final List<JWK> keys, final Map<String,Object> customMembers) { 141 142 if (keys == null) { 143 throw new IllegalArgumentException("The JWK list must not be null"); 144 } 145 146 this.keys = Collections.unmodifiableList(keys); 147 148 this.customMembers = Collections.unmodifiableMap(customMembers); 149 } 150 151 152 /** 153 * Gets the keys (ordered) of this JSON Web Key (JWK) set. 154 * 155 * @return The keys, empty list if none. 156 */ 157 public List<JWK> getKeys() { 158 159 return keys; 160 } 161 162 163 /** 164 * Gets the key from this JSON Web Key (JWK) set as identified by its 165 * Key ID (kid) member. 166 * 167 * <p>If more than one key exists in the JWK Set with the same 168 * identifier, this function returns only the first one in the set. 169 * 170 * @param kid They key identifier. 171 * 172 * @return The key identified by {@code kid} or {@code null} if no key 173 * exists. 174 */ 175 public JWK getKeyByKeyId(String kid) { 176 177 for (JWK key : getKeys()) { 178 179 if (key.getKeyID() != null && key.getKeyID().equals(kid)) { 180 return key; 181 } 182 } 183 184 // no key found 185 return null; 186 } 187 188 189 /** 190 * Gets the additional custom members of this JSON Web Key (JWK) set. 191 * 192 * @return The additional custom members, empty map if none. 193 */ 194 public Map<String,Object> getAdditionalMembers() { 195 196 return customMembers; 197 } 198 199 200 /** 201 * Returns a copy of this JSON Web Key (JWK) set with all private keys 202 * and parameters removed. 203 * 204 * @return A copy of this JWK set with all private keys and parameters 205 * removed. 206 */ 207 public JWKSet toPublicJWKSet() { 208 209 List<JWK> publicKeyList = new LinkedList<>(); 210 211 for (JWK key: keys) { 212 213 JWK publicKey = key.toPublicJWK(); 214 215 if (publicKey != null) { 216 publicKeyList.add(publicKey); 217 } 218 } 219 220 return new JWKSet(publicKeyList, customMembers); 221 } 222 223 224 /** 225 * Returns the JSON object representation of this JSON Web Key (JWK) 226 * set. Private keys and parameters will be omitted from the output. 227 * Use the alternative {@link #toJSONObject(boolean)} method if you 228 * wish to include them. 229 * 230 * @return The JSON object representation. 231 */ 232 public JSONObject toJSONObject() { 233 234 return toJSONObject(true); 235 } 236 237 238 /** 239 * Returns the JSON object representation of this JSON Web Key (JWK) 240 * set. 241 * 242 * @param publicKeysOnly Controls the inclusion of private keys and 243 * parameters into the output JWK members. If 244 * {@code true} private keys and parameters will 245 * be omitted. If {@code false} all available key 246 * parameters will be included. 247 * 248 * @return The JSON object representation. 249 */ 250 public JSONObject toJSONObject(final boolean publicKeysOnly) { 251 252 JSONObject o = new JSONObject(customMembers); 253 254 JSONArray a = new JSONArray(); 255 256 for (JWK key: keys) { 257 258 if (publicKeysOnly) { 259 260 // Try to get public key, then serialise 261 JWK publicKey = key.toPublicJWK(); 262 263 if (publicKey != null) { 264 a.add(publicKey.toJSONObject()); 265 } 266 } else { 267 268 a.add(key.toJSONObject()); 269 } 270 } 271 272 o.put("keys", a); 273 274 return o; 275 } 276 277 278 /** 279 * Returns the JSON object string representation of this JSON Web Key 280 * (JWK) set. 281 * 282 * @return The JSON object string representation. 283 */ 284 @Override 285 public String toString() { 286 287 return toJSONObject().toString(); 288 } 289 290 291 /** 292 * Parses the specified string representing a JSON Web Key (JWK) set. 293 * 294 * @param s The string to parse. Must not be {@code null}. 295 * 296 * @return The JWK set. 297 * 298 * @throws ParseException If the string couldn't be parsed to a valid 299 * JSON Web Key (JWK) set. 300 */ 301 public static JWKSet parse(final String s) 302 throws ParseException { 303 304 return parse(JSONObjectUtils.parse(s)); 305 } 306 307 308 /** 309 * Parses the specified JSON object representing a JSON Web Key (JWK) 310 * set. 311 * 312 * @param json The JSON object to parse. Must not be {@code null}. 313 * 314 * @return The JWK set. 315 * 316 * @throws ParseException If the string couldn't be parsed to a valid 317 * JSON Web Key (JWK) set. 318 */ 319 public static JWKSet parse(final JSONObject json) 320 throws ParseException { 321 322 JSONArray keyArray = JSONObjectUtils.getJSONArray(json, "keys"); 323 324 List<JWK> keys = new LinkedList<>(); 325 326 for (int i=0; i < keyArray.size(); i++) { 327 328 if (! (keyArray.get(i) instanceof JSONObject)) { 329 throw new ParseException("The \"keys\" JSON array must contain JSON objects only", 0); 330 } 331 332 JSONObject keyJSON = (JSONObject)keyArray.get(i); 333 334 try { 335 keys.add(JWK.parse(keyJSON)); 336 337 } catch (ParseException e) { 338 339 throw new ParseException("Invalid JWK at position " + i + ": " + e.getMessage(), 0); 340 } 341 } 342 343 // Parse additional custom members 344 Map<String, Object> additionalMembers = new HashMap<>(); 345 for (Map.Entry<String,Object> entry: json.entrySet()) { 346 347 if (entry.getKey() == null || entry.getKey().equals("keys")) { 348 continue; 349 } 350 351 additionalMembers.put(entry.getKey(), entry.getValue()); 352 } 353 354 return new JWKSet(keys, additionalMembers); 355 } 356 357 358 /** 359 * Loads a JSON Web Key (JWK) set from the specified input stream. 360 * 361 * @param inputStream The JWK set input stream. Must not be {@code null}. 362 * 363 * @return The JWK set. 364 * 365 * @throws IOException If the input stream couldn't be read. 366 * @throws ParseException If the input stream couldn't be parsed to a valid 367 * JSON Web Key (JWK) set. 368 */ 369 public static JWKSet load(final InputStream inputStream) 370 throws IOException, ParseException { 371 372 return parse(IOUtils.readInputStreamToString(inputStream, Charset.forName("UTF-8"))); 373 } 374 375 376 /** 377 * Loads a JSON Web Key (JWK) set from the specified file. 378 * 379 * @param file The JWK set file. Must not be {@code null}. 380 * 381 * @return The JWK set. 382 * 383 * @throws IOException If the file couldn't be read. 384 * @throws ParseException If the file couldn't be parsed to a valid 385 * JSON Web Key (JWK) set. 386 */ 387 public static JWKSet load(final File file) 388 throws IOException, ParseException { 389 390 return parse(IOUtils.readFileToString(file, Charset.forName("UTF-8"))); 391 } 392 393 394 /** 395 * Loads a JSON Web Key (JWK) set from the specified URL. 396 * 397 * @param url The JWK set URL. Must not be {@code null}. 398 * @param connectTimeout The URL connection timeout, in milliseconds. 399 * If zero no (infinite) timeout. 400 * @param readTimeout The URL read timeout, in milliseconds. If zero 401 * no (infinite) timeout. 402 * @param sizeLimit The read size limit, in bytes. If zero no 403 * limit. 404 * 405 * @return The JWK set. 406 * 407 * @throws IOException If the file couldn't be read. 408 * @throws ParseException If the file couldn't be parsed to a valid 409 * JSON Web Key (JWK) set. 410 */ 411 public static JWKSet load(final URL url, 412 final int connectTimeout, 413 final int readTimeout, 414 final int sizeLimit) 415 throws IOException, ParseException { 416 417 RestrictedResourceRetriever resourceRetriever = new DefaultResourceRetriever( 418 connectTimeout, 419 readTimeout, 420 sizeLimit); 421 Resource resource = resourceRetriever.retrieveResource(url); 422 return parse(resource.getContent()); 423 } 424 425 426 /** 427 * Loads a JSON Web Key (JWK) set from the specified URL. 428 * 429 * @param url The JWK set URL. Must not be {@code null}. 430 * 431 * @return The JWK set. 432 * 433 * @throws IOException If the file couldn't be read. 434 * @throws ParseException If the file couldn't be parsed to a valid 435 * JSON Web Key (JWK) set. 436 */ 437 public static JWKSet load(final URL url) 438 throws IOException, ParseException { 439 440 return load(url, 0, 0, 0); 441 } 442 443 444 /** 445 * Loads a JSON Web Key (JWK) set from the specified JCA key store. Key 446 * conversion exceptions are silently swallowed. PKCS#11 stores are 447 * also supported. Requires BouncyCastle. 448 * 449 * <p><strong>Important:</strong> The X.509 certificates are not 450 * validated! 451 * 452 * @param keyStore The key store. Must not be {@code null}. 453 * @param pwLookup The password lookup for password-protected keys, 454 * {@code null} if not specified. 455 * 456 * @return The JWK set, empty if no keys were loaded. 457 * 458 * @throws KeyStoreException On a key store exception. 459 */ 460 public static JWKSet load(final KeyStore keyStore, final PasswordLookup pwLookup) 461 throws KeyStoreException { 462 463 List<JWK> jwks = new LinkedList<>(); 464 465 // Load RSA and EC keys 466 for (Enumeration<String> keyAliases = keyStore.aliases(); keyAliases.hasMoreElements(); ) { 467 468 final String keyAlias = keyAliases.nextElement(); 469 final char[] keyPassword = pwLookup == null ? "".toCharArray() : pwLookup.lookupPassword(keyAlias); 470 471 Certificate cert = keyStore.getCertificate(keyAlias); 472 if (cert == null) { 473 continue; // skip 474 } 475 476 if (cert.getPublicKey() instanceof RSAPublicKey) { 477 478 RSAKey rsaJWK; 479 try { 480 rsaJWK = RSAKey.load(keyStore, keyAlias, keyPassword); 481 } catch (JOSEException e) { 482 continue; // skip cert 483 } 484 485 if (rsaJWK == null) { 486 continue; // skip key 487 } 488 489 jwks.add(rsaJWK); 490 491 } else if (cert.getPublicKey() instanceof ECPublicKey) { 492 493 ECKey ecJWK; 494 try { 495 ecJWK = ECKey.load(keyStore, keyAlias, keyPassword); 496 } catch (JOSEException e) { 497 continue; // skip cert 498 } 499 500 if (ecJWK != null) { 501 jwks.add(ecJWK); 502 } 503 504 } else { 505 continue; 506 } 507 } 508 509 510 // Load symmetric keys 511 for (Enumeration<String> keyAliases = keyStore.aliases(); keyAliases.hasMoreElements(); ) { 512 513 final String keyAlias = keyAliases.nextElement(); 514 final char[] keyPassword = pwLookup == null ? "".toCharArray() : pwLookup.lookupPassword(keyAlias); 515 516 OctetSequenceKey octJWK; 517 try { 518 octJWK = OctetSequenceKey.load(keyStore, keyAlias, keyPassword); 519 } catch (JOSEException e) { 520 continue; // skip key 521 } 522 523 if (octJWK != null) { 524 jwks.add(octJWK); 525 } 526 } 527 528 return new JWKSet(jwks); 529 } 530}