Java JWTClaimsSet类代码示例

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
/**
 * Check whether the token has been released to the expected audience
 */
private boolean validateTokenAudience(JWTClaimsSet claims) {
    List<String> audiences = claims.getAudience();

    if (audiences == null) {
        log.error("The authorization token doesn't have an audience (aud)");
        return false;
    }

    if (audiences.contains(this.audience)) {
        return true;
    }

    log.error("The authorization token audience `{}` doesn't match the expected audience `{}`",
        audiences, this.audience);

    return false;
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
/**
 * Check whether the token has been released by the expected issuer
 */
private Boolean validateTokenIssuer(JWTClaimsSet claims) {

    String issuer = claims.getIssuer();
    if (issuer == null) {
        log.error("The authorization token doesn't have an issuer (iss)");
        return false;
    }

    if (issuer.toLowerCase().equals(this.issuer)) {
        return true;
    }

    log.error("The authorization token issuer `{}` doesn't match the expected issuer `{}`",
        issuer, this.issuer);

    return false;
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
/**
 * parseJWT
 * Parse JWT and  Display Token Information in Logs.
 *
 * @param jwt Token to be Parsed
 */
@Override
public void parseAndDumpJWT(final String jwt) throws Exception {
    /**
     * This line will throw an exception if it is not a signed JWS (as expected)
     */
    JWTClaimsSet claimsSet = verifyToken(jwt);
    if (claimsSet == null) {
        LOGGER.error("{}No Claims Set returned, Invalid Token.",LOGGING_HEADER);
        return;
    }
    LOGGER.info("{} Dumping JWT: '{}'", LOGGING_HEADER, jwt);
    for(String claimKey : claimsSet.getClaims().keySet()) {
        LOGGER.info("{} ++ Claim '{}' = '{}'", LOGGING_HEADER,
                claimKey, claimsSet.getClaims().get(claimKey));
    }
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
private ConfigurableJWTProcessor<SecurityContext> getAadJwtTokenValidator()
        throws MalformedURLException {
    final ConfigurableJWTProcessor<SecurityContext> jwtProcessor = new DefaultJWTProcessor<>();
    final JWKSource<SecurityContext> keySource = new RemoteJWKSet<>(
            new URL(KEY_DISCOVERY_URI));
    final JWSAlgorithm expectedJWSAlg = JWSAlgorithm.RS256;
    final JWSKeySelector<SecurityContext> keySelector = new JWSVerificationKeySelector<>(expectedJWSAlg, keySource);
    jwtProcessor.setJWSKeySelector(keySelector);

    jwtProcessor.setJWTClaimsSetVerifier(new DefaultJWTClaimsVerifier<SecurityContext>() {
        @Override
        public void verify(JWTClaimsSet claimsSet, SecurityContext ctx) throws BadJWTException {
            super.verify(claimsSet, ctx);
            final String issuer = claimsSet.getIssuer();
            if (issuer == null || !issuer.contains("https://sts.windows.net/")) {
                throw new BadJWTException("Invalid token issuer");
            }
        }
    });
    return jwtProcessor;
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
@Test
public void implicitWithIdTokenAndToken_minimumParams_isSuccess() throws Exception {
	BearerAccessToken accessToken = new BearerAccessToken();
	JWT idToken = new PlainJWT(new JWTClaimsSet.Builder().build());

	given(this.clientRepository.findById(any(ClientID.class))).willReturn(implicitWithIdTokenAndTokenClient());
	given(this.tokenService.createAccessToken(any(AccessTokenRequest.class))).willReturn(accessToken);
	given(this.tokenService.createIdToken(any(IdTokenRequest.class))).willReturn(idToken);
	given(this.subjectResolver.resolveSubject(any(HttpServletRequest.class))).willReturn(new Subject("user"));
	given(this.scopeResolver.resolve(any(Subject.class), any(Scope.class), any(OIDCClientMetadata.class)))
			.will(returnsSecondArg());

	MockHttpServletRequestBuilder request = get(
			"/oauth2/authorize?scope=openid&response_type=id_token token&client_id=test-client&redirect_uri=http://example.com&nonce=test")
					.session(this.session);
	this.mvc.perform(request).andExpect(status().isFound())
			.andExpect(redirectedUrlTemplate(
					"http://example.com#access_token={accessToken}&id_token={idToken}&token_type=Bearer",
					accessToken.getValue(), idToken.serialize()));
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
@Test
public void implicitWithIdToken_minimumParams_isSuccess() throws Exception {
	JWT idToken = new PlainJWT(new JWTClaimsSet.Builder().build());

	given(this.clientRepository.findById(any(ClientID.class))).willReturn(implicitWithIdTokenClient());
	given(this.tokenService.createIdToken(any(IdTokenRequest.class))).willReturn(idToken);
	given(this.subjectResolver.resolveSubject(any(HttpServletRequest.class))).willReturn(new Subject("user"));
	given(this.scopeResolver.resolve(any(Subject.class), any(Scope.class), any(OIDCClientMetadata.class)))
			.will(returnsSecondArg());

	MockHttpServletRequestBuilder request = get(
			"/oauth2/authorize?scope=openid&response_type=id_token&client_id=test-client&redirect_uri=http://example.com&nonce=test")
					.session(this.session);
	this.mvc.perform(request).andExpect(status().isFound())
			.andExpect(redirectedUrlTemplate("http://example.com#id_token={idToken}", idToken.serialize()));
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
@Test
public void implicitWithIdTokenAndToken_withState_isSuccess() throws Exception {
	BearerAccessToken accessToken = new BearerAccessToken();
	JWT idToken = new PlainJWT(new JWTClaimsSet.Builder().build());
	State state = new State();

	given(this.clientRepository.findById(any(ClientID.class))).willReturn(implicitWithIdTokenAndTokenClient());
	given(this.tokenService.createAccessToken(any(AccessTokenRequest.class))).willReturn(accessToken);
	given(this.tokenService.createIdToken(any(IdTokenRequest.class))).willReturn(idToken);
	given(this.subjectResolver.resolveSubject(any(HttpServletRequest.class))).willReturn(new Subject("user"));
	given(this.scopeResolver.resolve(any(Subject.class), any(Scope.class), any(OIDCClientMetadata.class)))
			.will(returnsSecondArg());

	MockHttpServletRequestBuilder request = get(
			"/oauth2/authorize?scope=openid&response_type=id_token token&client_id=test-client&redirect_uri=http://example.com&nonce=test&state="
					+ state.getValue()).session(this.session);
	this.mvc.perform(request).andExpect(status().isFound()).andExpect(redirectedUrlTemplate(
			"http://example.com#access_token={accessToken}&id_token={idToken}&state={state}&token_type=Bearer",
			accessToken.getValue(), idToken.serialize(), state.getValue()));
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
@Test
public void hybridWithIdTokenAndToken_minimumParams_isSuccess() throws Exception {
	BearerAccessToken accessToken = new BearerAccessToken();
	JWT idToken = new PlainJWT(new JWTClaimsSet.Builder().build());
	AuthorizationCode authorizationCode = new AuthorizationCode();

	given(this.clientRepository.findById(any(ClientID.class))).willReturn(hybridWithIdTokenAndTokenClient());
	given(this.tokenService.createAccessToken(any(AccessTokenRequest.class))).willReturn(accessToken);
	given(this.tokenService.createIdToken(any(IdTokenRequest.class))).willReturn(idToken);
	given(this.authorizationCodeService.create(any(AuthorizationCodeContext.class))).willReturn(authorizationCode);
	given(this.subjectResolver.resolveSubject(any(HttpServletRequest.class))).willReturn(new Subject("user"));
	given(this.scopeResolver.resolve(any(Subject.class), any(Scope.class), any(OIDCClientMetadata.class)))
			.will(returnsSecondArg());

	MockHttpServletRequestBuilder request = get(
			"/oauth2/authorize?scope=openid&response_type=code id_token token&client_id=test-client&redirect_uri=http://example.com&nonce=test")
					.session(this.session);
	this.mvc.perform(request).andExpect(status().isFound()).andExpect(redirectedUrlTemplate(
			"http://example.com#access_token={accessToken}&code={code}&id_token={idToken}&token_type=Bearer",
			accessToken.getValue(), authorizationCode.getValue(), idToken.serialize()));
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
@Test
public void hybridWithIdToken_minimumParams_isSuccess() throws Exception {
	JWT idToken = new PlainJWT(new JWTClaimsSet.Builder().build());
	AuthorizationCode authorizationCode = new AuthorizationCode();

	given(this.clientRepository.findById(any(ClientID.class))).willReturn(hybridWithIdTokenClient());
	given(this.tokenService.createIdToken(any(IdTokenRequest.class))).willReturn(idToken);
	given(this.authorizationCodeService.create(any(AuthorizationCodeContext.class))).willReturn(authorizationCode);
	given(this.subjectResolver.resolveSubject(any(HttpServletRequest.class))).willReturn(new Subject("user"));
	given(this.scopeResolver.resolve(any(Subject.class), any(Scope.class), any(OIDCClientMetadata.class)))
			.will(returnsSecondArg());

	MockHttpServletRequestBuilder request = get(
			"/oauth2/authorize?scope=openid&response_type=code id_token&client_id=test-client&redirect_uri=http://example.com&nonce=test")
					.session(this.session);
	this.mvc.perform(request).andExpect(status().isFound())
			.andExpect(redirectedUrlTemplate("http://example.com#code={code}&id_token={idToken}",
					authorizationCode.getValue(), idToken.serialize()));
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
@Test
public void hybridWithIdTokenAndToken_withState_isSuccess() throws Exception {
	BearerAccessToken accessToken = new BearerAccessToken();
	JWT idToken = new PlainJWT(new JWTClaimsSet.Builder().build());
	AuthorizationCode authorizationCode = new AuthorizationCode();
	State state = new State();

	given(this.clientRepository.findById(any(ClientID.class))).willReturn(hybridWithIdTokenAndTokenClient());
	given(this.tokenService.createAccessToken(any(AccessTokenRequest.class))).willReturn(accessToken);
	given(this.tokenService.createIdToken(any(IdTokenRequest.class))).willReturn(idToken);
	given(this.authorizationCodeService.create(any(AuthorizationCodeContext.class))).willReturn(authorizationCode);
	given(this.subjectResolver.resolveSubject(any(HttpServletRequest.class))).willReturn(new Subject("user"));
	given(this.scopeResolver.resolve(any(Subject.class), any(Scope.class), any(OIDCClientMetadata.class)))
			.will(returnsSecondArg());

	MockHttpServletRequestBuilder request = get(
			"/oauth2/authorize?scope=openid&response_type=code id_token token&client_id=test-client&redirect_uri=http://example.com&nonce=test&state="
					+ state.getValue()).session(this.session);
	this.mvc.perform(request).andExpect(status().isFound()).andExpect(redirectedUrlTemplate(
			"http://example.com#access_token={accessToken}&code={code}&id_token={idToken}&state={state}&token_type=Bearer",
			accessToken.getValue(), authorizationCode.getValue(), idToken.serialize(), state.getValue()));
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
@Test
public void authCode_postAuth_isOk() throws Exception {
	ClientID clientId = new ClientID("test-client");
	URI redirectUri = URI.create("http://rp.example.com");
	AuthorizationCode authorizationCode = new AuthorizationCode();

	ClientSecretPost clientAuth = new ClientSecretPost(clientId, new Secret("test-secret"));
	TokenRequest tokenRequest = new TokenRequest(URI.create("http://op.example.com"), clientAuth,
			new AuthorizationCodeGrant(authorizationCode, redirectUri));

	AuthorizationCodeContext context = new AuthorizationCodeContext(new Subject("user"), clientId, redirectUri,
			new Scope(OIDCScopeValue.OPENID), Instant.now(), new ACR("1"), AMR.PWD, new SessionID("test"), null,
			null, null);
	BearerAccessToken accessToken = new BearerAccessToken();
	JWT idToken = new PlainJWT(new JWTClaimsSet.Builder().build());

	given(this.clientRepository.findById(any(ClientID.class)))
			.willReturn(client(ClientAuthenticationMethod.CLIENT_SECRET_POST));
	given(this.authorizationCodeService.consume(eq(authorizationCode))).willReturn(context);
	given(this.tokenService.createAccessToken(any(AccessTokenRequest.class))).willReturn(accessToken);
	given(this.tokenService.createIdToken(any(IdTokenRequest.class))).willReturn(idToken);

	MockHttpServletRequestBuilder request = post("/oauth2/token").content(tokenRequest.toHTTPRequest().getQuery())
			.contentType(MediaType.APPLICATION_FORM_URLENCODED);
	this.mvc.perform(request).andExpect(status().isOk());
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
@Test
public void authCode_pkcePlain_isOk() throws Exception {
	ClientID clientId = new ClientID("test-client");
	URI redirectUri = URI.create("http://rp.example.com");
	CodeVerifier codeVerifier = new CodeVerifier();
	CodeChallengeMethod codeChallengeMethod = CodeChallengeMethod.PLAIN;
	AuthorizationCode authorizationCode = new AuthorizationCode();

	TokenRequest tokenRequest = new TokenRequest(URI.create("http://op.example.com"), clientId,
			new AuthorizationCodeGrant(authorizationCode, redirectUri, codeVerifier));

	AuthorizationCodeContext context = new AuthorizationCodeContext(new Subject("user"), clientId, redirectUri,
			new Scope(OIDCScopeValue.OPENID), Instant.now(), new ACR("1"), AMR.PWD, new SessionID("test"),
			CodeChallenge.compute(codeChallengeMethod, codeVerifier), codeChallengeMethod, null);
	BearerAccessToken accessToken = new BearerAccessToken();
	JWT idToken = new PlainJWT(new JWTClaimsSet.Builder().build());

	given(this.clientRepository.findById(any(ClientID.class))).willReturn(client(ClientAuthenticationMethod.NONE));
	given(this.authorizationCodeService.consume(eq(authorizationCode))).willReturn(context);
	given(this.tokenService.createAccessToken(any(AccessTokenRequest.class))).willReturn(accessToken);
	given(this.tokenService.createIdToken(any(IdTokenRequest.class))).willReturn(idToken);

	MockHttpServletRequestBuilder request = post("/oauth2/token").content(tokenRequest.toHTTPRequest().getQuery())
			.contentType(MediaType.APPLICATION_FORM_URLENCODED);
	this.mvc.perform(request).andExpect(status().isOk());
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
@Test
public void authCode_pkceS256_isOk() throws Exception {
	ClientID clientId = new ClientID("test-client");
	URI redirectUri = URI.create("http://rp.example.com");
	CodeVerifier codeVerifier = new CodeVerifier();
	CodeChallengeMethod codeChallengeMethod = CodeChallengeMethod.S256;
	AuthorizationCode authorizationCode = new AuthorizationCode();

	TokenRequest tokenRequest = new TokenRequest(URI.create("http://op.example.com"), clientId,
			new AuthorizationCodeGrant(authorizationCode, URI.create("http://rp.example.com"), codeVerifier));

	AuthorizationCodeContext context = new AuthorizationCodeContext(new Subject("user"), clientId, redirectUri,
			new Scope(OIDCScopeValue.OPENID), Instant.now(), new ACR("1"), AMR.PWD, new SessionID("test"),
			CodeChallenge.compute(codeChallengeMethod, codeVerifier), codeChallengeMethod, null);
	BearerAccessToken accessToken = new BearerAccessToken();
	JWT idToken = new PlainJWT(new JWTClaimsSet.Builder().build());

	given(this.clientRepository.findById(any(ClientID.class))).willReturn(client(ClientAuthenticationMethod.NONE));
	given(this.authorizationCodeService.consume(eq(authorizationCode))).willReturn(context);
	given(this.tokenService.createAccessToken(any(AccessTokenRequest.class))).willReturn(accessToken);
	given(this.tokenService.createIdToken(any(IdTokenRequest.class))).willReturn(idToken);

	MockHttpServletRequestBuilder request = post("/oauth2/token").content(tokenRequest.toHTTPRequest().getQuery())
			.contentType(MediaType.APPLICATION_FORM_URLENCODED);
	this.mvc.perform(request).andExpect(status().isOk());
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
String generateCookieBody(int secondsToLive) {
    RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
    JWSSigner signer = new RSASSASigner(privateKey);

    DateTime expDate = new DateTime((new Date()).getTime() + secondsToLive * 1000);

    JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
            .issuer("digital-display-garden")
            .claim("exp", expDate.toString())
            .build();

    SignedJWT signedJWT = new SignedJWT(
            new JWSHeader(JWSAlgorithm.RS256),
            claimsSet
    );
    try {
        signedJWT.sign(signer);
        return signedJWT.serialize();
    } catch (JOSEException e) {
        e.printStackTrace();
        return "";
    }
}
 

import com.nimbusds.jwt.JWTClaimsSet; //导入依赖的package包/类
String generateSharedGoogleSecret(String originatingURL) {
    RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
    JWSSigner signer = new RSASSASigner(privateKey);

    // Expire in 60 seconds
    DateTime expDate = new DateTime((new Date()).getTime() + 60 * 1000);

    JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
            .issuer("digital-display-garden")
            .claim("originatingURL", originatingURL)
            .claim("exp", expDate.toString())
            .build();

    SignedJWT signedJWT = new SignedJWT(
            new JWSHeader(JWSAlgorithm.RS256),
            claimsSet
    );
    try {
        signedJWT.sign(signer);
        return signedJWT.serialize();
    } catch (JOSEException e) {
        e.printStackTrace();
        return "";
    }
}