net.loginbuddy.common/src/main/java/net/loginbuddy/common/util/Jwt.java
/**
     * Validates the signature, aud, iss, exp and nonce of a given JWT. Other values have to be verified on demand
     *
     * @param jwt               The JWT to be validated
     * @param jsonWebKeySetJson The JSON Web Key Set as a JSON string. This may be null if the JWT includes the 'sub_jwk' claim
     * @param expectedIss       Expected issuer of the JWT
     * @param expectedAud       Expected audience
     * @param expectedNonce     Expected nonce
     */
Validates the signature, aud, iss, exp and nonce of a given JWT. Other values have to be verified on demand
@param jwt               The JWT to be validated
@param jsonWebKeySetJson The JSON Web Key Set as a JSON string. This may be null if the JWT includes the 'sub_jwk' claim
@param expectedIss       Expected issuer of the JWT
@param expectedAud       Expected audience
@param expectedNonce     Expected nonce
Validates the signature aud iss exp and nonce of a given JWT . Other values have to be verified on demand @param jwt The JWT to be validated @param jsonWebKeySetJson The JSON Web Key Set as a JSON string . This may be null if the JWT includes the ' sub_jwk ' claim @param expectedIss Expected issuer of the JWT @param expectedAud Expected audience @param expectedNonce Expected nonce
@Deprecated
    public JSONObject validateJwt(String jwt, String jsonWebKeySetJson, String expectedIss, String expectedAud, String expectedNonce) {
        if (jwt == null || expectedIss == null || expectedAud == null || expectedNonce == null) {
            LOGGER.warning("All parameters are required! Verify that neither empty nor null values have been used!");
            throw new IllegalArgumentException("All parameters are required!");
        }
        try {
            JsonWebSignature jws = new JsonWebSignature();
            jws.setCompactSerialization(jwt);
            JSONObject jo = (JSONObject) new org.json.simple.parser.JSONParser().parse(jws.getUnverifiedPayload());
            if (expectedIss.equals(jo.get("iss"))) {
                if (validateAud(expectedAud, jo.get("aud"))) {
                    if (expectedNonce.equals(jo.get("nonce"))) {
                        if ((new Date().getTime() / 1000) < Long.parseLong(String.valueOf(jo.get("exp")))) {
                            JsonWebKey jwk = null;
                            if (jo.get("sub_jwk") != null && jsonWebKeySetJson == null) {
                                jwk = JsonWebKey.Factory.newJwk(((JSONObject) jo.get("sub_jwk")).toJSONString());
                            } else {
                                JsonWebKeySet jsonWebKeySet = new JsonWebKeySet(jsonWebKeySetJson);
                                VerificationJwkSelector jwkSelector = new VerificationJwkSelector();
                                jwk = jwkSelector.select(jws, jsonWebKeySet.getJsonWebKeys());
                            }
                            jws.setKey(jwk.getKey());
                            String jwkAlg = jwk.getAlgorithm() == null ? "RS256" : jwk.getAlgorithm(); 
                            if (jwkAlg.equalsIgnoreCase(jws.getAlgorithmHeaderValue())) {
                                if (jws.verifySignature()) {
                                    return jo;
                                } else {
                                    LOGGER.warning("The JWT signature is invalid!");
                                }
                            } else {
                                LOGGER.warning("The JWT has been signed with an unexpected algorithm!");
                            }
                        } else {
                            LOGGER.warning("The JWT has expired!");
                        }
                    } else {
                        LOGGER.warning("Unexpected nonce. Expected: '" + expectedNonce + "', actual: '" + jo.get("nonce") + "'");
                    }
                } else {
                    LOGGER.warning("Unexpected aud. Expected: '" + expectedAud + "', actual: '" + jo.get("aud") + "'");
                }
            } else {
                LOGGER.warning("Unexpected iss. Expected: '" + expectedIss + "', actual: '" + jo.get("iss") + "'");
            }
        } catch (Exception e) {
            LOGGER.warning("No sure what went wrong ... check the stacktrace below ... ");
            e.printStackTrace();
            throw new IllegalArgumentException("The given JWT could not be parsed or decoded!");
        }
        throw new IllegalArgumentException("The given JWT could not be parsed or decoded!");
    }
@ Deprecated public JSONObject validateJwt ( String jwt , String jsonWebKeySetJson , String expectedIss , String expectedAud , String expectedNonce ) { if ( jwt == null || expectedIss == null || expectedAud == null || expectedNonce == null ) { LOGGER . warning ( "All parameters are required! Verify that neither empty nor null values have been used!" ) ; throw new IllegalArgumentException ( "All parameters are required!" ) ; } try { JsonWebSignature jws = new JsonWebSignature ( ) ; jws . setCompactSerialization ( jwt ) ; JSONObject jo = ( JSONObject ) new org . json . simple . parser . JSONParser ( ) . parse ( jws . getUnverifiedPayload ( ) ) ; if ( expectedIss . equals ( jo . get ( "iss" ) ) ) { if ( validateAud ( expectedAud , jo . get ( "aud" ) ) ) { if ( expectedNonce . equals ( jo . get ( "nonce" ) ) ) { if ( ( new Date ( ) . getTime ( ) / 1000 ) < Long . parseLong ( String . valueOf ( jo . get ( "exp" ) ) ) ) { JsonWebKey jwk = null ; if ( jo . get ( "sub_jwk" ) != null && jsonWebKeySetJson == null ) { jwk = JsonWebKey . Factory . newJwk ( ( ( JSONObject ) jo . get ( "sub_jwk" ) ) . toJSONString ( ) ) ; } else { JsonWebKeySet jsonWebKeySet = new JsonWebKeySet ( jsonWebKeySetJson ) ; VerificationJwkSelector jwkSelector = new VerificationJwkSelector ( ) ; jwk = jwkSelector . select ( jws , jsonWebKeySet . getJsonWebKeys ( ) ) ; } jws . setKey ( jwk . getKey ( ) ) ; String jwkAlg = jwk . getAlgorithm ( ) == null ? "RS256" : jwk . getAlgorithm ( ) ; if ( jwkAlg . equalsIgnoreCase ( jws . getAlgorithmHeaderValue ( ) ) ) { if ( jws . verifySignature ( ) ) { return jo ; } else { LOGGER . warning ( "The JWT signature is invalid!" ) ; } } else { LOGGER . warning ( "The JWT has been signed with an unexpected algorithm!" ) ; } } else { LOGGER . warning ( "The JWT has expired!" ) ; } } else { LOGGER . warning ( "Unexpected nonce. Expected: '" + expectedNonce + "', actual: '" + jo . get ( "nonce" ) + "'" ) ; } } else { LOGGER . warning ( "Unexpected aud. Expected: '" + expectedAud + "', actual: '" + jo . get ( "aud" ) + "'" ) ; } } else { LOGGER . warning ( "Unexpected iss. Expected: '" + expectedIss + "', actual: '" + jo . get ( "iss" ) + "'" ) ; } } catch ( Exception e ) { LOGGER . warning ( "No sure what went wrong ... check the stacktrace below ... " ) ; e . printStackTrace ( ) ; throw new IllegalArgumentException ( "The given JWT could not be parsed or decoded!" ) ; } throw new IllegalArgumentException ( "The given JWT could not be parsed or decoded!" ) ; }
Validates the signature, aud, iss, exp and nonce of a given JWT.
Validates the signature aud iss exp and nonce of a given JWT .
// simple string comparisons first // since 'alg' in JWKS is optional, we use RS256 as the default value