Class ReactiveJwksSignature

java.lang.Object

io.micronaut.security.token.jwt.nimbus.ReactiveJwksSignature

All Implemented Interfaces:

ReactiveSignatureConfiguration<com.nimbusds.jwt.SignedJWT>

@EachBean(JwksSignatureConfiguration.class)
public class ReactiveJwksSignature
extends Object
implements ReactiveSignatureConfiguration<com.nimbusds.jwt.SignedJWT>

Signature configuration which enables verification of remote JSON Web Key Set. A bean of this class is created for each JwksSignatureConfiguration.

If the configuration is bound to an issuer (JwksSignatureConfiguration.getIssuer()), only tokens whose iss claim matches that issuer (see IssuerUtils.equivalent(String, String)) are verified with the key set. Tokens issued by another issuer, or without an iss claim, are not verified, even if their signature validates against one of the keys. The issuer is a binding on the key set, which keys are trusted to sign tokens of which issuer, and is checked before the key set is consulted. It does not replace the validation of the iss claim by the claims validators.

If the configuration specifies a key type, only keys of that type (kty) are used to verify a token. A token signed with a key of another type is not verified, even if that key is part of the key set.

Since:

4.8.0

Author:

Sergio del Amo

Constructor Summary

Constructors

Constructor	Description
ReactiveJwksSignature(JwksSignatureConfiguration jwksSignatureConfiguration, JwkValidator jwkValidator, JwkSetFetcher<com.nimbusds.jose.jwk.JWKSet> jwkSetFetcher)

Method Summary

Modifier and Type	Method	Description
org.reactivestreams.Publisher<Boolean>	verify(com.nimbusds.jwt.SignedJWT jwt)	Verify a signed JWT.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ReactiveJwksSignature

public ReactiveJwksSignature(JwksSignatureConfiguration jwksSignatureConfiguration,
 JwkValidator jwkValidator,
 JwkSetFetcher<com.nimbusds.jose.jwk.JWKSet> jwkSetFetcher)

Parameters:

jwksSignatureConfiguration - JSON Web Key Set configuration.

jwkValidator - JWK Validator to be used.

jwkSetFetcher - Json Web Key Set fetcher

Method Details

verify

@SingleResult
public org.reactivestreams.Publisher<Boolean> verify(com.nimbusds.jwt.SignedJWT jwt)

Verify a signed JWT. Emits false without consulting the key set if the configuration is bound to an issuer and the iss claim of the JWT does not match it. Only keys whose type matches JwksSignatureConfiguration.getKeyType() are considered, if a key type is configured.

Specified by:

verify in interface ReactiveSignatureConfiguration<com.nimbusds.jwt.SignedJWT>

Parameters:

jwt - the signed JWT

Returns:

whether the signed JWT is verified