1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.apache.syncope.core.spring.security.jws;
20
21 import com.nimbusds.jose.JOSEException;
22 import com.nimbusds.jose.JWSAlgorithm;
23 import com.nimbusds.jose.JWSHeader;
24 import com.nimbusds.jose.JWSVerifier;
25 import com.nimbusds.jose.crypto.MACVerifier;
26 import com.nimbusds.jose.crypto.RSASSAVerifier;
27 import com.nimbusds.jose.jca.JCAContext;
28 import com.nimbusds.jose.util.Base64URL;
29 import java.security.KeyFactory;
30 import java.security.NoSuchAlgorithmException;
31 import java.security.interfaces.RSAPublicKey;
32 import java.security.spec.InvalidKeySpecException;
33 import java.security.spec.X509EncodedKeySpec;
34 import java.util.Base64;
35 import java.util.Set;
36 import org.apache.commons.lang3.StringUtils;
37
38 public class AccessTokenJWSVerifier implements JWSVerifier {
39
40 private final JWSVerifier delegate;
41
42 public AccessTokenJWSVerifier(final JWSAlgorithm jwsAlgorithm, final String jwsKey)
43 throws JOSEException, NoSuchAlgorithmException, InvalidKeySpecException {
44
45 if (JWSAlgorithm.Family.RSA.contains(jwsAlgorithm)) {
46 if (jwsKey.indexOf(':') == -1) {
47 throw new IllegalArgumentException("A key pair is required, in the 'private:public' format");
48 }
49
50 KeyFactory kf = KeyFactory.getInstance("RSA");
51 X509EncodedKeySpec keySpecX509 = new X509EncodedKeySpec(
52 Base64.getDecoder().decode(StringUtils.substringAfter(jwsKey, ":").getBytes()));
53 delegate = new RSASSAVerifier((RSAPublicKey) kf.generatePublic(keySpecX509));
54 } else if (JWSAlgorithm.Family.HMAC_SHA.contains(jwsAlgorithm)) {
55 delegate = new MACVerifier(jwsKey);
56 } else {
57 throw new IllegalArgumentException("Unsupported JWS algorithm: " + jwsAlgorithm.getName());
58 }
59 }
60
61 @Override
62 public Set<JWSAlgorithm> supportedJWSAlgorithms() {
63 return delegate.supportedJWSAlgorithms();
64 }
65
66 @Override
67 public JCAContext getJCAContext() {
68 return delegate.getJCAContext();
69 }
70
71 @Override
72 public boolean verify(
73 final JWSHeader header,
74 final byte[] signingInput,
75 final Base64URL signature) throws JOSEException {
76
77 return delegate.verify(header, signingInput, signature);
78 }
79 }