reinstated signing and validation service

openid-connect-common/src/main/java/org/mitre/jwt/signer/service/JwtSigningAndValidationService.java

@@ -0,0 +1,64 @@
+/*******************************************************************************
+ * Copyright 2012 The MITRE Corporation
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+package org.mitre.jwt.signer.service;
+
+import java.security.NoSuchAlgorithmException;
+import java.util.Map;
+
+import org.mitre.jwt.model.Jwt;
+import org.mitre.jwt.signer.JwtSigner;
+
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.SignedJWT;
+
+public interface JwtSigningAndValidationService {
+
+	/**
+	 * Checks the signature of the given JWT against all configured signers,
+	 * returns true if at least one of the signers validates it.
+	 * 
+	 * @param jwtString
+	 *            the string representation of the JWT as sent on the wire
+	 * @return true if the signature is valid, false if not
+	 * @throws NoSuchAlgorithmException 
+	 */
+	public boolean validateSignature(SignedJWT jwtString);
+	
+	/**
+	 * Called to sign a jwt in place for a client that hasn't registered a preferred signing algorithm.
+	 * Use the default algorithm to sign.
+	 * 
+	 * @param jwt the jwt to sign
+	 * @return the signed jwt
+	 * @throws NoSuchAlgorithmException 
+	 */
+	public void signJwt(SignedJWT jwt) throws NoSuchAlgorithmException;
+
+	/**
+	 * Sign a jwt using the selected algorithm. The algorithm is selected using the String parameter values specified
+	 * in the JWT spec, section 6. I.E., "HS256" means HMAC with SHA-256 and corresponds to our HmacSigner class.
+	 * 
+	 * @param jwt the jwt to sign
+	 * @param alg the name of the algorithm to use, as specified in JWS s.6
+	 * @return the signed jwt
+	 */
+	//TODO: implement later; only need signJwt(Jwt jwt) for now
+	//public Jwt signJwt(Jwt jwt, String alg);
+	
+	/**
+	 * TODO: method to sign a jwt using a specified algorithm and a key id
+	 */
+}

openid-connect-common/src/main/java/org/mitre/jwt/signer/service/impl/DefaultJwtSigningAndValidationService.java

@@ -0,0 +1,120 @@
+/*******************************************************************************
+ * Copyright 2012 The MITRE Corporation
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+package org.mitre.jwt.signer.service.impl;
+
+import java.security.NoSuchAlgorithmException;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.mitre.jwt.signer.service.JwtSigningAndValidationService;
+import org.mitre.openid.connect.config.ConfigurationPropertiesBean;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.beans.factory.annotation.Autowired;
+
+import com.nimbusds.jose.JOSEException;
+import com.nimbusds.jose.JWSSigner;
+import com.nimbusds.jose.JWSVerifier;
+import com.nimbusds.jwt.SignedJWT;
+
+public class DefaultJwtSigningAndValidationService implements JwtSigningAndValidationService, InitializingBean {
+
+	@Autowired 
+	private ConfigurationPropertiesBean configBean;
+	
+	// map of identifier to signer
+	private Map<String, ? extends JWSSigner> signers = new HashMap<String, JWSSigner>();
+	// map of identifier to verifier
+	private Map<String, ? extends JWSVerifier> verifiers = new HashMap<String, JWSVerifier>();
+
+	private static Logger logger = LoggerFactory.getLogger(DefaultJwtSigningAndValidationService.class);
+
+	/**
+	 * default constructor
+	 */
+	public DefaultJwtSigningAndValidationService() {
+	}
+
+	/*
+	 * (non-Javadoc)
+	 * 
+	 * @see
+	 * org.springframework.beans.factory.InitializingBean#afterPropertiesSet()
+	 */
+	@Override
+	public void afterPropertiesSet(){
+		// used for debugging...
+		if (!signers.isEmpty()) {
+			logger.info(this.toString());
+		}
+
+		logger.info("DefaultJwtSigningAndValidationService is open for business");
+
+	}
+
+	/**
+	 * @return the configBean
+	 */
+	public ConfigurationPropertiesBean getConfigBean() {
+		return configBean;
+	}
+
+	/**
+	 * @param configBean the configBean to set
+	 */
+	public void setConfigBean(ConfigurationPropertiesBean configBean) {
+		this.configBean = configBean;
+	}
+	
+
+	/**
+	 * Sign a jwt in place using the configured default signer.
+	 * @throws JOSEException 
+	 * @throws NoSuchAlgorithmException 
+	 */
+	@Override
+	public void signJwt(SignedJWT jwt) {
+		String signerId = configBean.getDefaultJwtSigner();
+		
+		JWSSigner signer = signers.get(signerId);
+		
+		try {
+	        jwt.sign(signer);
+        } catch (JOSEException e) {
+	        // TODO Auto-generated catch block
+	        e.printStackTrace();
+        }
+		
+	}
+	
+	@Override
+	public boolean validateSignature(SignedJWT jwt) {
+
+		for (JWSVerifier verifier : verifiers.values()) {
+			try {
+				if (jwt.verify(verifier)) {
+					return true;
+				}
+			} catch (JOSEException e) {
+	            // TODO Auto-generated catch block
+	            e.printStackTrace();
+            }
+		}
+		return false;
+	}
+
+}