View Javadoc
1   /*
2    * Licensed to the Apache Software Foundation (ASF) under one
3    * or more contributor license agreements.  See the NOTICE file
4    * distributed with this work for additional information
5    * regarding copyright ownership.  The ASF licenses this file
6    * to you under the Apache License, Version 2.0 (the
7    * "License"); you may not use this file except in compliance
8    * with the License.  You may obtain a copy of the License at
9    *
10   *   http://www.apache.org/licenses/LICENSE-2.0
11   *
12   * Unless required by applicable law or agreed to in writing,
13   * software distributed under the License is distributed on an
14   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15   * KIND, either express or implied.  See the License for the
16   * specific language governing permissions and limitations
17   * under the License.
18   */
19  package org.apache.syncope.core.spring.security.jws;
20  
21  import com.nimbusds.jose.JOSEException;
22  import com.nimbusds.jose.JWSAlgorithm;
23  import com.nimbusds.jose.JWSHeader;
24  import com.nimbusds.jose.JWSVerifier;
25  import com.nimbusds.jose.crypto.MACVerifier;
26  import com.nimbusds.jose.crypto.RSASSAVerifier;
27  import com.nimbusds.jose.jca.JCAContext;
28  import com.nimbusds.jose.util.Base64URL;
29  import java.security.KeyFactory;
30  import java.security.NoSuchAlgorithmException;
31  import java.security.interfaces.RSAPublicKey;
32  import java.security.spec.InvalidKeySpecException;
33  import java.security.spec.X509EncodedKeySpec;
34  import java.util.Base64;
35  import java.util.Set;
36  import org.apache.commons.lang3.StringUtils;
37  
38  public class AccessTokenJWSVerifier implements JWSVerifier {
39  
40      private final JWSVerifier delegate;
41  
42      public AccessTokenJWSVerifier(final JWSAlgorithm jwsAlgorithm, final String jwsKey)
43              throws JOSEException, NoSuchAlgorithmException, InvalidKeySpecException {
44  
45          if (JWSAlgorithm.Family.RSA.contains(jwsAlgorithm)) {
46              if (jwsKey.indexOf(':') == -1) {
47                  throw new IllegalArgumentException("A key pair is required, in the 'private:public' format");
48              }
49  
50              KeyFactory kf = KeyFactory.getInstance("RSA");
51              X509EncodedKeySpec keySpecX509 = new X509EncodedKeySpec(
52                      Base64.getDecoder().decode(StringUtils.substringAfter(jwsKey, ":").getBytes()));
53              delegate = new RSASSAVerifier((RSAPublicKey) kf.generatePublic(keySpecX509));
54          } else if (JWSAlgorithm.Family.HMAC_SHA.contains(jwsAlgorithm)) {
55              delegate = new MACVerifier(jwsKey);
56          } else {
57              throw new IllegalArgumentException("Unsupported JWS algorithm: " + jwsAlgorithm.getName());
58          }
59      }
60  
61      @Override
62      public Set<JWSAlgorithm> supportedJWSAlgorithms() {
63          return delegate.supportedJWSAlgorithms();
64      }
65  
66      @Override
67      public JCAContext getJCAContext() {
68          return delegate.getJCAContext();
69      }
70  
71      @Override
72      public boolean verify(
73              final JWSHeader header,
74              final byte[] signingInput,
75              final Base64URL signature) throws JOSEException {
76  
77          return delegate.verify(header, signingInput, signature);
78      }
79  }