Package org.codice.ddf.security.oidc.validator

Class OidcTokenValidator

java.lang.Object

org.codice.ddf.security.oidc.validator.OidcTokenValidator

public class OidcTokenValidator
extends Object

Method Summary

Modifier and Type	Method	Description
static void	validateAccessToken(com.nimbusds.oauth2.sdk.token.AccessToken accessToken, com.nimbusds.jwt.JWT idToken, com.nimbusds.jose.util.ResourceRetriever resourceRetriever, com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata metadata, org.pac4j.oidc.config.OidcConfiguration configuration)	Validates an access token.
static com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet	validateIdTokens(com.nimbusds.jwt.JWT idToken, org.pac4j.core.context.WebContext webContext, org.pac4j.oidc.config.OidcConfiguration configuration, org.pac4j.oidc.client.OidcClient client)	Validates id tokens.
static void	validateUserInfoIdToken(com.nimbusds.jwt.JWT idToken, com.nimbusds.jose.util.ResourceRetriever resourceRetriever, com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata metadata)	Validates id tokens received from the userinfo endpoint.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

validateIdTokens

public static com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet validateIdTokens(com.nimbusds.jwt.JWT idToken,
 org.pac4j.core.context.WebContext webContext,
 org.pac4j.oidc.config.OidcConfiguration configuration,
 org.pac4j.oidc.client.OidcClient client)
                                                                                throws OidcValidationException

Validates id tokens.

• If the ID token is not signed, an exception is thrown
• If the ID token is signed, the required signing algorithm list from the metadata is used along with the header to validate it

Parameters:

idToken - - id token to validate

webContext - - the web context used to get the session information

configuration - - oidc configuration

Throws:

OidcValidationException

validateUserInfoIdToken

public static void validateUserInfoIdToken(com.nimbusds.jwt.JWT idToken,
 com.nimbusds.jose.util.ResourceRetriever resourceRetriever,
 com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata metadata)
                                    throws OidcValidationException

Validates id tokens received from the userinfo endpoint.

• If the ID token is not signed, validation is ignored
• If the ID token is signed
  • If the userinfo signing algorithms are listed in the metadata, we use that information along with the header attributes to validate the token
  • If the userinfo signing algorithms are NOT listed in the metadata, we just use the header attributes to validate the token

Parameters:

idToken - - id token to validate

resourceRetriever - - resource retriever

metadata - - OIDC metadata

Throws:

OidcValidationException

validateAccessToken

public static void validateAccessToken(com.nimbusds.oauth2.sdk.token.AccessToken accessToken,
 com.nimbusds.jwt.JWT idToken,
 com.nimbusds.jose.util.ResourceRetriever resourceRetriever,
 com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata metadata,
 org.pac4j.oidc.config.OidcConfiguration configuration)
                                throws OidcValidationException

Validates an access token.

Parameters:

accessToken - - token to validate

idToken - - the corresponding id token or null if one is not available

resourceRetriever - - resource retriever

metadata - - OIDC metadata

Throws:

OidcValidationException