Java JsonWebStructure类代码示例

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
@Test
public void testAnEx() throws Exception
{
    String location = "https://www.example.org/";

    Get mockGet = mock(Get.class);
    when(mockGet.get(location)).thenThrow(new IOException(location + "says 'no GET for you!'"));
    HttpsJwks httpsJkws = new HttpsJwks(location);
    httpsJkws.setSimpleHttpGet(mockGet);
    HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(httpsJkws);

    JsonWebSignature jws = new JsonWebSignature();
    jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256);
    jws.setKeyIdHeaderValue("nope");
    try
    {
        Key key = resolver.resolveKey(jws, Collections.<JsonWebStructure>emptyList());
        fail("shouldn't have resolved a key but got " + key);

    }
    catch (UnresolvableKeyException e)
    {
        log.debug("this was expected and is okay: {}", e.toString());
    }
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
public static SimpleJwkFilter commonFilterForInbound(JsonWebStructure jwx) throws JoseException
{
    SimpleJwkFilter filter = new SimpleJwkFilter();
    String kid = jwx.getKeyIdHeaderValue();
    if (kid != null)
    {
        filter.setKid(kid, SimpleJwkFilter.VALUE_REQUIRED);
    }

    String x5t = jwx.getX509CertSha1ThumbprintHeaderValue();
    String x5tS256 = jwx.getX509CertSha256ThumbprintHeaderValue();
    filter.setAllowFallbackDeriveFromX5cForX5Thumbs(true);
    if (x5t != null)
    {
        filter.setX5t(x5t, SimpleJwkFilter.OMITTED_OKAY);
    }
    if (x5tS256 != null)
    {
        filter.setX5tS256(x5tS256, SimpleJwkFilter.OMITTED_OKAY);
    }

    String keyType = jwx.getAlgorithm().getKeyType();
    filter.setKty(keyType);
    String use = (jwx instanceof JsonWebSignature) ? Use.SIGNATURE : Use.ENCRYPTION;
    filter.setUse(use, SimpleJwkFilter.OMITTED_OKAY);
    return filter;
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
static void expectValidationFailure(JwtClaims jwtClaims, JwtConsumer jwtConsumer)
{
    try
    {
        jwtConsumer.validate(new JwtContext(jwtClaims, Collections.<JsonWebStructure>emptyList()));
        Assert.fail("claims validation should have thrown an exception");
    }
    catch (InvalidJwtException e)
    {
        log.debug("Expected exception: {}", e.toString());
    }
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
@Test
public void nestedBackwards() throws Exception
{
    // a JWT that's a JWE inside a JWS, which is unusual but legal
    String jwt = "eyJjdHkiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.ZXlKNmFYQWlPaUpFUlVZaUxDSmhiR2NpT2lKRlEwUklMVVZUSWl3aVpXNWpJam9pUVRFeU9FTkNReTFJVXpJMU5pSXNJbVZ3YXlJNmV5SnJkSGtpT2lKRlF5SXNJbmdpT2lKYVIwczNWbkZOUzNKV1VGcEphRXc1UkRsT05tTnpNV0ZhYlU5MVpqbHlUWGhtUm1kRFVURjFaREJuSWl3aWVTSTZJbTAyZW01VlQybEtjMnMwTlRaRVVWb3RjVTEzZEVKblpqQkRNVXh4VDB0dk5HYzNjakpGUTBkQllUZ2lMQ0pqY25ZaU9pSlFMVEkxTmlKOWZRLi4xSndRWThoVFJVczdUMFNpOWM1VE9RLkFOdUpNcFowTU1KLTBrbVdvVHhvRDlxLTA1YUxrMkpvRzMxLXdVZ01ZakdaaWZiWG96SDEzZGRuaXZpWXNtenhMcFdVNU1lQnptN3J3TExTeUlCdjB3LmVEb1lFTEhFWXBnMHFpRzBaeHUtWEE.NctFu0mNSArPnMXakIMQKagWyU4v7733dNhDNK3KwiFP2MahpfaH0LA7x0knRk0sjASRxDuEIW6UZGfPTFOjkw";

    PublicJsonWebKey sigKey = PublicJsonWebKey.Factory.newPublicJwk("{\"kty\":\"EC\",\"x\":\"HVDkXtG_j_JQUm_mNaRPSbsEhr6gdK0a6H4EURypTU0\",\"y\":\"NxdYFS2hl1w8VKf5UTpGXh2YR7KQ8gSBIHu64W0mK8M\",\"crv\":\"P-256\",\"d\":\"ToqTlgJLhI7AQYNLesI2i-08JuaYm2wxTCDiF-VxY4A\"}");
    PublicJsonWebKey encKey = PublicJsonWebKey.Factory.newPublicJwk("{\"kty\":\"EC\",\"x\":\"7kaETHB4U9pCdsErbjw11HGv8xcQUmFy3NMuBa_J7Os\",\"y\":\"FZK-vSMpKk9gLWC5wdFjG1W_C7vgJtdm1YfNPZevmCw\",\"crv\":\"P-256\",\"d\":\"spOxtF0qiKrrCTaUs_G04RISjCx7HEgje_I7aihXVMY\"}");

    JwtConsumer firstPassConsumer = new JwtConsumerBuilder()
            .setDecryptionKey(encKey.getPrivateKey())
            .setSkipAllValidators()
            .setDisableRequireSignature()
            .setSkipSignatureVerification()
            .build();
    JwtContext jwtContext = firstPassConsumer.process(jwt);

    JwtConsumer consumer = new JwtConsumerBuilder()
            .setDecryptionKey(encKey.getPrivateKey())
            .setVerificationKey(sigKey.getPublicKey())
            .setEvaluationTime(NumericDate.fromSeconds(1420226222))
            .setExpectedAudience("canada")
            .setExpectedIssuer("usa")
            .setRequireExpirationTime()
            .build();
    JwtContext ctx = consumer.process(jwt);
    consumer.processContext(jwtContext);

    for (JwtContext context : new JwtContext[] {ctx, jwtContext})
    {
        JwtClaims jwtClaims = context.getJwtClaims();
        Assert.assertThat("eh", equalTo(jwtClaims.getStringClaimValue("message")));
        List<JsonWebStructure> joseObjects = context.getJoseObjects();
        assertThat(2, equalTo(joseObjects.size()));
        assertTrue(joseObjects.get(0) instanceof JsonWebEncryption);
        assertTrue(joseObjects.get(1) instanceof JsonWebSignature);
    }

}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
void expectNoProviderProduce(JsonWebStructure jwx)
{
    try
    {
        String compactSerialization = jwx.getCompactSerialization();
        Assert.fail("Shouldn't have gotten compact serialization " + compactSerialization);
    }
    catch (JoseException e)
    {
        Assert.assertThat(e.getMessage(), CoreMatchers.containsString(NO_SUCH_PROVIDER));
    }
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
void expectNoProviderConsume(JsonWebStructure jwx)
{
    try
    {
        String inside = jwx.getPayload();
        Assert.fail("Shouldn't have gotten payload " + inside);
    }
    catch (JoseException e)
    {
        Assert.assertThat(e.getMessage(), CoreMatchers.containsString(NO_SUCH_PROVIDER));
    }
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
public static void expectFail(JsonWebStructure jwx)
{
    try
    {
        jwx.getPayload();
        fail("should have failed due to crit header");
    }
    catch (JoseException e)
    {
        log.debug("Expected something like this: {}", e.toString());
    }
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
@Override
public JWTData getJWTData(String jwt) throws JWTError {
    String keyId = null;
    JWTData jwtData;
    try {
        JwtConsumer consumer = new JwtConsumerBuilder()
                .setSkipAllValidators()
                .setSkipSignatureVerification()
                .build();
        JwtContext jwtContext = consumer.process(jwt);
        for (JsonWebStructure joseObject : jwtContext.getJoseObjects()) {
            keyId = joseObject.getKeyIdHeaderValue();
            if (keyId != null) {
                break;
            }
        }
        if (keyId == null) {
            throw new JWTError("No kid found!", null);
        }
        JwtClaims claims = consumer.processToClaims(jwt);
        jwtData = new JWTData(
                claims.getIssuer(),
                claims.getSubject(),
                claims.getAudience().get(0),
                keyId
        );
    } catch (InvalidJwtException|MalformedClaimException e) {
        throw new JWTError("An error occurred parsing the JWT", e);
    }
    return jwtData;
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
public JwtContext(JwtClaims jwtClaims, List<JsonWebStructure> joseObjects)
{
    this.jwtClaims = jwtClaims;
    this.joseObjects = joseObjects;
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
private boolean isNestedJwt(JsonWebStructure joseObject)
{
    String cty = joseObject.getContentTypeHeaderValue();
    return cty != null && (cty.equalsIgnoreCase("jwt") || cty.equalsIgnoreCase("application/jwt"));
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
@Override
public Key resolveKey(JsonWebEncryption jwe, List<JsonWebStructure> nestingContext)
{
    return key;
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
@Override
public Key resolveKey(JsonWebSignature jws, List<JsonWebStructure> nestingContext) throws UnresolvableKeyException
{
    String x5t = jws.getX509CertSha1ThumbprintHeaderValue();
    String x5tS256 = jws.getX509CertSha256ThumbprintHeaderValue();

    if (x5t == null && x5tS256 == null)
    {
        if (tryAllOnNoThumbHeader)
        {
            return attemptAll(jws);
        }
        throw new UnresolvableKeyException("Neither the " + X509_CERTIFICATE_THUMBPRINT + " header nor the " + X509_CERTIFICATE_SHA256_THUMBPRINT + " header are present in the JWS.");
    }

    X509Certificate x509Certificate = x5tMap.get(x5t);
    if (x509Certificate == null)
    {
        x509Certificate = x5tS256Map.get(x5tS256);
    }

    if (x509Certificate == null)
    {
        StringBuilder sb = new StringBuilder();

        sb.append("The X.509 Certificate Thumbprint header(s) in the JWS do not identify any of the provided Certificates -");
        if (x5t != null)
        {
            sb.append(" ").append(X509_CERTIFICATE_THUMBPRINT).append("=").append(x5t);
            sb.append(" vs. SHA-1 thumbs:").append(x5tMap.keySet());
        }

        if (x5tS256 != null)
        {
            sb.append(" ").append(X509_CERTIFICATE_SHA256_THUMBPRINT).append("=").append(x5tS256);
            sb.append(" vs. SHA-256 thumbs:").append(x5tS256Map.keySet());
        }

        sb.append(".");
        throw new UnresolvableKeyException(sb.toString());
    }

    return x509Certificate.getPublicKey();
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
static void goodValidate(JwtClaims jwtClaims, JwtConsumer jwtConsumer) throws InvalidJwtException
{
    jwtConsumer.validate(new JwtContext(jwtClaims, Collections.<JsonWebStructure>emptyList()));
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
@Test
public void missingCtyInNested() throws Exception
{
    // Nested jwt without "cty":"JWT" -> expect failure here as the cty is a MUST for nesting
    // setEnableLiberalContentTypeHandling() on the builder will enable a best effort to deal with the content even when cty isn't specified

    String jwt = "eyJ6aXAiOiJERUYiLCJhbGciOiJFQ0RILUVTIiwiZW5jIjoiQTEyOENCQy1IUzI1NiIsImVwayI6eyJrdHkiOiJFQyIsIngiOiIwRGk0VTBZQ0R2NHAtS2hETUZwUThvY0FsZzA2SEwzSHR6UldRbzlDLWV3IiwieSI6IjBfVFJjR1Y3Qy05d0xseFJZSExJOFlKTXlET2hWNW5YeHVPMGdRVmVxd0EiLCJjcnYiOiJQLTI1NiJ9fQ..xw5H8Kztd_sqzbXjt4GKUg.YNa163HLj7MwlvjzGihbOHnJ2PC3NOTnnvVOanuk1O9XFJ97pbbHHQzEeEwG6jfvDgdmlrLjcIJkSu1U8qRby7Xr4gzP6CkaDPbKwvLveETZSNdmZh37XKfnQ4LvKgiko6OQzyLYG1gc97kUOeikXTYVaYaeV1838Bi4q3DsIG-j4ZESg0-ePQesw56A80AEE3j6wXwZ4vqugPP9_ogZzkPFcHf1lt3-A4amNMjDbV8.u-JJCoakXI55BG2rz_kBlg";
    PublicJsonWebKey sigKey = PublicJsonWebKey.Factory.newPublicJwk("{\"kty\":\"EC\",\"x\":\"loF6m9WAW_GKrhoh48ctg_d78fbIsmUb02XDOwJj59c\",\"y\":\"kDCHDkCbWjeX8DjD9feQKcndJyerdsLJ4VZ5YSTWCoU\",\"crv\":\"P-256\",\"d\":\"6D1C9gJsT9KXNtTNyqgpdyQuIrK-qzo0_QJOVe9DqJg\"}");
    PublicJsonWebKey encKey = PublicJsonWebKey.Factory.newPublicJwk("{\"kty\":\"EC\",\"x\":\"PNbMydlpYRBFTYn_XDFvvRAFqE4e0EJmK6-zULTVERs\",\"y\":\"dyO9wGVgKS3gtP5bx0PE8__MOV_HLSpiwK-mP1RGZgk\",\"crv\":\"P-256\",\"d\":\"FIs8wVojHBdl7vkiZVnLBPw5S9lbn4JF2WWY1OTupic\"}");

    JwtConsumer firstPassConsumer = new JwtConsumerBuilder()
            .setDecryptionKey(encKey.getPrivateKey())
            .setSkipAllValidators()
            .setDisableRequireSignature()
            .setSkipSignatureVerification()
            .setEnableLiberalContentTypeHandling()
            .build();

    JwtContext jwtContext = firstPassConsumer.process(jwt);

    JwtConsumer consumer = new JwtConsumerBuilder()
            .setDecryptionKey(encKey.getPrivateKey())
            .setVerificationKey(sigKey.getPublicKey())
            .setEvaluationTime(NumericDate.fromSeconds(1420219088))
            .setExpectedAudience("canada")
            .setExpectedIssuer("usa")
            .setRequireExpirationTime()
            .build();
    SimpleJwtConsumerTestHelp.expectProcessingFailure(jwt, consumer);

    consumer = new JwtConsumerBuilder()
            .setEnableLiberalContentTypeHandling()
            .setDecryptionKey(encKey.getPrivateKey())
            .setVerificationKey(sigKey.getPublicKey())
            .setEvaluationTime(NumericDate.fromSeconds(1420219088))
            .setExpectedAudience("canada")
            .setExpectedIssuer("usa")
            .setRequireExpirationTime()
            .build();
    JwtContext ctx = consumer.process(jwt);
    consumer.processContext(jwtContext);

    for (JwtContext context : new JwtContext[] {ctx, jwtContext})
    {
        JwtClaims jwtClaims = context.getJwtClaims();
        Assert.assertThat("eh", equalTo(jwtClaims.getStringClaimValue("message")));
        List<JsonWebStructure> joseObjects = context.getJoseObjects();
        assertThat(2, equalTo(joseObjects.size()));
        assertTrue(joseObjects.get(0) instanceof JsonWebSignature);
        assertTrue(joseObjects.get(1) instanceof JsonWebEncryption);
    }
}
 

import org.jose4j.jwx.JsonWebStructure; //导入依赖的package包/类
@Test
public void missingCtyInNestedViaNimbusExample() throws Exception
{
    // "Signed and encrypted JSON Web Token (JWT)" example JWT made from http://connect2id.com/products/nimbus-jose-jwt/examples/signed-and-encrypted-jwt
    // didn't have "cty":"JWT" at the time of writing (1/5/15 - https://twitter.com/__b_c/status/552105927512301568) but it made me think
    // allowing more liberal processing might be a good idea
    // keys and enc alg were changed from the example to produce this jwt
    final String jwt =
            "eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0." +
            "IAseIHBLnv7hFKz_V3-o-Of3Mf2DIGzFnSh_8sLZgujPaNIG8NlZmA." +
            "fwbuvibqYUlDzTXTtsB6yw." +
            "5T70ZVMqOTl4q_tYegL0bgJpT2wTUlSvnJ2QAB8KfpNO_J3StiK8oHvSmVOPOrCQJai_XffZGUpmAO2fnGnUajKmQpxm_iaJUZtzexwqeNlVzAr-swLUZDmW0lh3NgDB" +
                "EAgY4khN7v1L_etToKuuEI6P-UGsg34BqaNuZEkj7ylsY1McZg73t5x9C4Q9dsBbsPLFPPUxxvA2abJhAq1Hew." +
            "D1hDq8pD6nQ42yvez-yjlQ\n";

    AesKey decryptionKey = new AesKey(new byte[16]);

    JwtConsumer firstPassConsumer = new JwtConsumerBuilder()
            .setDecryptionKey(decryptionKey)
            .setSkipAllValidators()
            .setDisableRequireSignature()
            .setSkipSignatureVerification()
            .setEnableLiberalContentTypeHandling()
            .build();

    JwtContext jwtContext = firstPassConsumer.process(jwt);

    final JwtConsumer consumer = new JwtConsumerBuilder()
            .setEnableLiberalContentTypeHandling() // this will try nested content as JOSE if JSON paring fails
            .setDecryptionKey(decryptionKey)
            .setVerificationKey(new AesKey(new byte[32]))
            .setEvaluationTime(NumericDate.fromSeconds(1420467806))
            .setExpectedIssuer("https://c2id.com")
            .setRequireIssuedAt()
            .build();

    JwtContext ctx = consumer.process(jwt);

    for (JwtContext context : new JwtContext[] {ctx, jwtContext})
    {
        JwtClaims jwtClaims = context.getJwtClaims();
        Assert.assertThat("alice", equalTo(jwtClaims.getSubject()));
        List<JsonWebStructure> joseObjects = context.getJoseObjects();
        assertThat(2, equalTo(joseObjects.size()));
        assertTrue(joseObjects.get(0) instanceof JsonWebSignature);
        assertTrue(joseObjects.get(1) instanceof JsonWebEncryption);
    }
}