Package org.gcube.common.security.secrets

Class JWTSecret

java.lang.Object
org.gcube.common.security.secrets.Secret
org.gcube.common.security.secrets.JWTSecret
Direct Known Subclasses:
UmaTokenSecret
public class JWTSecret extends org.gcube.common.security.secrets.Secret
A JSON Web Token issued by the D4Science IAM, e.g. the bearer token a service receives in the Authorization header. Its Context is its audience, which must be a single value.

The token is valid only when it is issued by one of the trusted IAM realms (setTrustedIssuers(Collection)) and its signature is verified with the key of that realm. The issuer is checked before any connection, so a token naming another realm is rejected without contacting it. Whoever hosts the code sets the trusted realms (SmartGears sets the realm of the container); while none is set, every token is rejected.

The claims (owner, Context, roles, expiration) are read from the payload of the token without verifying it: they can be trusted only after isValid() has returned true.

Author:
Luca Frosini (ISTI - CNR)

  • Field Details

    • KEYCLOAK_BASED_SECRET_PRIORITY

      public static final int KEYCLOAK_BASED_SECRET_PRIORITY
      Priority of the secrets based on the tokens of the IAM.
      See Also:

  • Constructor Details

    • JWTSecret

      public JWTSecret(String encodedToken)
      Creates the secret of an encoded token.
      Parameters:
      encodedToken - the encoded JWT

  • Method Details

    • setTrustedIssuers

      public static void setTrustedIssuers(Collection<String> issuers)
      Sets the IAM realms whose tokens are accepted, for the whole JVM.
      Parameters:
      issuers - the base URLs of the realms, as in the iss claim of their tokens, e.g. https://accounts.d4science.org/auth/realms/d4science; a trailing slash is ignored

    • getTrustedIssuers

      public static Set<String> getTrustedIssuers()
      Returns the IAM realms whose tokens are accepted.
      Returns:
      the base URLs of the realms, without trailing slash; empty when none is set

    • priority

      public int priority()
      Specified by:
      priority in class org.gcube.common.security.secrets.Secret

    • getOwner

      public org.gcube.common.security.Owner getOwner()
      Returns the owner named in the token. The claims are not verified here: trust them only when isValid() returns true.
      Specified by:
      getOwner in class org.gcube.common.security.secrets.Secret
      Returns:
      the owner of the token

    • getContext

      public String getContext()
      Returns the Context named in the audience of the token. The claims are not verified here: trust them only when isValid() returns true.
      Specified by:
      getContext in class org.gcube.common.security.secrets.Secret
      Returns:
      the Context of the token

    • getHTTPAuthorizationHeaders

      public Map<String,String> getHTTPAuthorizationHeaders()
      Specified by:
      getHTTPAuthorizationHeaders in class org.gcube.common.security.secrets.Secret

    • getEncodedToken

      protected String getEncodedToken()
      Returns the encoded token.
      Returns:
      the encoded JWT

    • isExpired

      public boolean isExpired()
      Specified by:
      isExpired in class org.gcube.common.security.secrets.Secret

    • isValid

      public boolean isValid()
      Tells whether the token is issued by a trusted IAM realm and its signature is verified with the key of that realm. The expiration is not checked here: see isExpired().
      Specified by:
      isValid in class org.gcube.common.security.secrets.Secret
      Returns:
      true when the token is valid