com.nimbusds.jwt.proc

Class DefaultJWTClaimsVerifier<C extends SecurityContext>

java.lang.Object

com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier<C>

All Implemented Interfaces:

ClockSkewAware, JWTClaimsSetVerifier<C>, JWTClaimsVerifier

@ThreadSafe
public class DefaultJWTClaimsVerifier<C extends SecurityContext>
extends Object
implements JWTClaimsSetVerifier<C>, JWTClaimsVerifier, ClockSkewAware

Default JWT claims verifier. This class is thread-safe.

Performs the following checks:

1. If an expiration time (exp) claim is present, makes sure it is ahead of the current time, else the JWT claims set is rejected.
2. If a not-before-time (nbf) claim is present, makes sure it is before the current time, else the JWT claims set is rejected.

This class may be extended to perform additional checks.

Version:

2019-10-15

Author:

Vladimir Dzhuvinov

Field Summary

Fields

Modifier and Type	Field and Description
static int	DEFAULT_MAX_CLOCK_SKEW_SECONDS The default maximum acceptable clock skew, in seconds (60).

Constructor Summary

Constructors

Constructor and Description
DefaultJWTClaimsVerifier()

Method Summary

Modifier and Type	Method and Description
String	getAcceptedAudience() Gets the accepted audience ("aud").
String	getAcceptedIssuer() Gets the accepted issuer ("iss").
int	getMaxClockSkew() Gets the maximum acceptable clock skew.
boolean	requiresExpirationTime() Gets the expiration time ("exp") requirement.
void	requiresExpirationTime(boolean expRequired) Sets the expiration time ("exp") requirement.
boolean	requiresIssuedAtTime() Gets the issued-at time ("iat") requirement.
void	requiresIssuedAtTime(boolean iatRequired) Sets the issued-at time ("iat") requirement.
boolean	requiresNotBeforeTime() Gets the not-before time ("nbf") requirement.
void	requiresNotBeforeTime(boolean nbfRequired) Sets the not-before time ("nbf") requirement.
void	setAcceptedAudience(String aud) Sets the accepted audience ("aud").
void	setAcceptedIssuer(String iss) Sets the accepted issuer ("iss").
void	setMaxClockSkew(int maxClockSkewSeconds) Sets the maximum acceptable clock skew.
void	verify(JWTClaimsSet claimsSet) Performs verification of selected or all claims in the specified JWT claims set.
void	verify(JWTClaimsSet claimsSet, C context) Verifies selected or all claims from the specified JWT claims set.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

DEFAULT_MAX_CLOCK_SKEW_SECONDS

public static final int DEFAULT_MAX_CLOCK_SKEW_SECONDS

The default maximum acceptable clock skew, in seconds (60).

See Also:

Constant Field Values

Constructor Detail

DefaultJWTClaimsVerifier

public DefaultJWTClaimsVerifier()

Method Detail

getMaxClockSkew

public int getMaxClockSkew()

Description copied from interface: ClockSkewAware

Gets the maximum acceptable clock skew.

Specified by:

getMaxClockSkew in interface ClockSkewAware

Returns:

The maximum acceptable clock skew, in seconds. Zero if none.

setMaxClockSkew

public void setMaxClockSkew(int maxClockSkewSeconds)

Description copied from interface: ClockSkewAware

Sets the maximum acceptable clock skew.

Specified by:

setMaxClockSkew in interface ClockSkewAware

Parameters:

maxClockSkewSeconds - The maximum acceptable clock skew, in seconds. Zero if none.

requiresIssuedAtTime

public boolean requiresIssuedAtTime()

Gets the issued-at time ("iat") requirement.

Returns:

true if the issued-at time claim is required, false if not.

Since:

8.1

requiresIssuedAtTime

public void requiresIssuedAtTime(boolean iatRequired)

Sets the issued-at time ("iat") requirement.

Parameters:

iatRequired - true if the issued-at time claim is required, false if not.

Since:

8.1

requiresExpirationTime

public boolean requiresExpirationTime()

Gets the expiration time ("exp") requirement.

Returns:

true if the expiration time claim is required, false if not.

Since:

8.1

requiresExpirationTime

public void requiresExpirationTime(boolean expRequired)

Sets the expiration time ("exp") requirement.

Parameters:

expRequired - true if the expiration time claim is required, false if not.

Since:

8.1

requiresNotBeforeTime

public boolean requiresNotBeforeTime()

Gets the not-before time ("nbf") requirement.

Returns:

true if the not-before time claim is required, false if not.

Since:

8.1

requiresNotBeforeTime

public void requiresNotBeforeTime(boolean nbfRequired)

Sets the not-before time ("nbf") requirement.

Parameters:

nbfRequired - true if the not-before time claim is required, false if not.

Since:

8.1

getAcceptedIssuer

public String getAcceptedIssuer()

Gets the accepted issuer ("iss").

Returns:

The accepted issuer, null if not specified.

Since:

8.1

setAcceptedIssuer

public void setAcceptedIssuer(String iss)

Sets the accepted issuer ("iss").

Parameters:

iss - The accepted issuer, null if not specified.

Since:

8.1

getAcceptedAudience

public String getAcceptedAudience()

Gets the accepted audience ("aud").

Returns:

The accepted audience, null if not specified.

Since:

8.1

setAcceptedAudience

public void setAcceptedAudience(String aud)

Sets the accepted audience ("aud").

Parameters:

aud - The accepted audience, null if not specified.

Since:

8.1

verify

public void verify(JWTClaimsSet claimsSet)
            throws BadJWTException

Description copied from interface: JWTClaimsVerifier

Performs verification of selected or all claims in the specified JWT claims set.

Specified by:

verify in interface JWTClaimsVerifier

Parameters:

claimsSet - The JWT claims set. Not null.

Throws:

BadJWTException - If the JWT claims set is rejected.

verify

public void verify(JWTClaimsSet claimsSet,
                   C context)
            throws BadJWTException

Description copied from interface: JWTClaimsSetVerifier

Verifies selected or all claims from the specified JWT claims set.

Specified by:

verify in interface JWTClaimsSetVerifier<C extends SecurityContext>

Parameters:

claimsSet - The JWT claims set. Not null.

context - Optional context, null if not required.

Throws:

BadJWTException - If the JWT claims set is rejected.