Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduce JwtEncoder #9208

Closed
wants to merge 20 commits into from
Closed

Introduce JwtEncoder #9208

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
7f37d18
Introduce JwtEncoder
jgrandja Nov 17, 2020
9b7b085
Introduce JwtEncoderParameters
jgrandja Sep 16, 2021
8c21bda
Rename NimbusJwsEncoder -> NimbusJwtEncoder
jgrandja Sep 16, 2021
f977ae6
Validate critical headers
jgrandja Sep 16, 2021
c88b3de
Polish tests
jgrandja Sep 16, 2021
48b63cd
Fix typo
jgrandja Sep 17, 2021
f5b3c51
Allow extension of JoseHeader
jgrandja Sep 17, 2021
19a79d6
Introduce JwsHeader
jgrandja Sep 17, 2021
57625d3
Disable JWE tests
jgrandja Sep 17, 2021
0f4e593
Allow headers to be optional
jgrandja Sep 17, 2021
0d68314
Update JWE tests
jgrandja Sep 17, 2021
4ccef38
Polish NimbusJweEncoderTests
jgrandja Sep 20, 2021
553f890
Add tests
jgrandja Sep 20, 2021
f6f96d2
Make JoseHeader package-private
jgrandja Sep 20, 2021
ee142b0
Rename TestJoseHeaders to TestJwsHeaders
jgrandja Sep 20, 2021
74f15f5
JwsHeader parameter should be required
jgrandja Sep 20, 2021
a5b54fd
Rename JwtEncoderParameters.with() to from()
jgrandja Sep 20, 2021
8dbae12
Add criticalHeader() convenience methods
jgrandja Sep 20, 2021
7a6218f
Polish "Add criticalHeader() convenience methods"
jgrandja Sep 21, 2021
132f833
Simplify "Add criticalHeader() convenience methods"
jgrandja Sep 21, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 13 additions & 8 deletions ...ork/security/oauth2/client/endpoint/NimbusJwtClientAuthenticationParametersConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,12 @@
import org.springframework.security.oauth2.jose.jws.JwsAlgorithm;
import org.springframework.security.oauth2.jose.jws.MacAlgorithm;
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
import org.springframework.security.oauth2.jwt.JwsHeader;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.jwt.JwtClaimsSet;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.JwtEncoderParameters;
import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
import org.springframework.util.Assert;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
Expand Down Expand Up @@ -122,7 +127,7 @@ public MultiValueMap<String, String> convert(T authorizationGrantRequest) {
throw new OAuth2AuthorizationException(oauth2Error);
}

JoseHeader.Builder headersBuilder = JoseHeader.withAlgorithm(jwsAlgorithm);
JwsHeader.Builder headersBuilder = JwsHeader.with(jwsAlgorithm);

Instant issuedAt = Instant.now();
Instant expiresAt = issuedAt.plus(Duration.ofSeconds(60));
Expand All @@ -137,7 +142,7 @@ public MultiValueMap<String, String> convert(T authorizationGrantRequest) {
.expiresAt(expiresAt);
// @formatter:on

JoseHeader joseHeader = headersBuilder.build();
JwsHeader jwsHeader = headersBuilder.build();
JwtClaimsSet jwtClaimsSet = claimsBuilder.build();

JwsEncoderHolder jwsEncoderHolder = this.jwsEncoders.compute(clientRegistration.getRegistrationId(),
Expand All @@ -146,11 +151,11 @@ public MultiValueMap<String, String> convert(T authorizationGrantRequest) {
return currentJwsEncoderHolder;
}
JWKSource<SecurityContext> jwkSource = new ImmutableJWKSet<>(new JWKSet(jwk));
return new JwsEncoderHolder(new NimbusJwsEncoder(jwkSource), jwk);
return new JwsEncoderHolder(new NimbusJwtEncoder(jwkSource), jwk);
});

NimbusJwsEncoder jwsEncoder = jwsEncoderHolder.getJwsEncoder();
Jwt jws = jwsEncoder.encode(joseHeader, jwtClaimsSet);
JwtEncoder jwsEncoder = jwsEncoderHolder.getJwsEncoder();
Jwt jws = jwsEncoder.encode(JwtEncoderParameters.with(jwsHeader, jwtClaimsSet));

MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
parameters.set(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE, CLIENT_ASSERTION_TYPE_VALUE);
Expand Down Expand Up @@ -186,16 +191,16 @@ else if (KeyType.OCT.equals(jwk.getKeyType())) {

private static final class JwsEncoderHolder {

private final NimbusJwsEncoder jwsEncoder;
private final JwtEncoder jwsEncoder;

private final JWK jwk;

private JwsEncoderHolder(NimbusJwsEncoder jwsEncoder, JWK jwk) {
private JwsEncoderHolder(JwtEncoder jwsEncoder, JWK jwk) {
this.jwsEncoder = jwsEncoder;
this.jwk = jwk;
}

private NimbusJwsEncoder getJwsEncoder() {
private JwtEncoder getJwsEncoder() {
return this.jwsEncoder;
}

Expand Down
1 change: 1 addition & 0 deletions ...ecurity/oauth2/client/endpoint/NimbusJwtClientAuthenticationParametersConverterTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
import org.springframework.security.oauth2.jose.TestJwks;
import org.springframework.security.oauth2.jose.jws.MacAlgorithm;
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
import org.springframework.security.oauth2.jwt.JoseHeaderNames;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.jwt.JwtClaimNames;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
Expand Down
Loading