com.nimbusds.openid.connect.provider.jwksetgen

Class JWKSetGenerator

java.lang.Object

com.nimbusds.openid.connect.provider.jwksetgen.JWKSetGenerator

public class JWKSetGenerator
extends Object

JWK set generators for Connect2id servers.

Constructor Summary

Constructors

Constructor and Description
JWKSetGenerator()

Method Summary

Modifier and Type	Method and Description
com.nimbusds.jose.jwk.JWKSet	generate(boolean withMessage) Generates a new JWK set for a Connect2id server.
com.nimbusds.jose.jwk.JWKSet	generateAndPrefixNewKeys(com.nimbusds.jose.jwk.JWKSet oldJWKSet, boolean withMessage) A generates a new set of signing and encryption keys and prefixes them to the specified Connect2id server JWK set.
protected static com.nimbusds.jose.jwk.OctetSequenceKey	generateEncryptionAESKey(String kid) Generates a 256 bit AES encryption key with the specified key ID.
protected static com.nimbusds.jose.jwk.OctetSequenceKey	generateHMACSHA256Key() Generates a 256 bit HMAC SHA key with key ID "hmac".
List<com.nimbusds.jose.jwk.JWK>	generatePermanentKeys(boolean withMessage) Generates a new set of permanent keys for a Connect2id server.
List<com.nimbusds.jose.jwk.JWK>	generateRotatingKeys(KeyIDs reservedKeyIDs, boolean withMessage) Generates a new set of rotating signature and encryption keys for a Connect2id server.
protected static com.nimbusds.jose.jwk.ECKey	generateSigningECKey(com.nimbusds.jose.jwk.ECKey.Curve crv, String kid) Generates an EC signing key with the specified curve and key ID.
protected static com.nimbusds.jose.jwk.RSAKey	generateSigningRSAKey(String kid) Generates a 2048 bit RSA signing key with the specified key ID.
protected static com.nimbusds.jose.jwk.OctetSequenceKey	generateSubjectEncryptionKey() Generates a 256 bit subject encryption key (intended for AES SIV mode) with key ID "subject-encrypt".
static void	main(String[] args) Console method for generating a new Connect2id server JWK set, or updating an existing JWK set with new signing and encryption keys.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

JWKSetGenerator

public JWKSetGenerator()

Method Detail

generateSigningRSAKey

protected static com.nimbusds.jose.jwk.RSAKey generateSigningRSAKey(String kid)
                                                             throws NoSuchAlgorithmException

Generates a 2048 bit RSA signing key with the specified key ID.

Parameters:

kid - The key ID, null if not specified.

Returns:

The RSA key pair.

Throws:

NoSuchAlgorithmException

generateSigningECKey

protected static com.nimbusds.jose.jwk.ECKey generateSigningECKey(com.nimbusds.jose.jwk.ECKey.Curve crv,
                                                                  String kid)
                                                           throws NoSuchAlgorithmException,
                                                                  InvalidAlgorithmParameterException

Generates an EC signing key with the specified curve and key ID.

Parameters:

crv - The curve. Must not be null.

kid - The key ID, null if not specified.

Returns:

The EC key pair.

Throws:

NoSuchAlgorithmException

InvalidAlgorithmParameterException

generateEncryptionAESKey

protected static com.nimbusds.jose.jwk.OctetSequenceKey generateEncryptionAESKey(String kid)
                                                                          throws NoSuchAlgorithmException

Generates a 256 bit AES encryption key with the specified key ID.

Parameters:

kid - The key ID, null if not specified.

Returns:

The AES key.

Throws:

NoSuchAlgorithmException

generateHMACSHA256Key

protected static com.nimbusds.jose.jwk.OctetSequenceKey generateHMACSHA256Key()
                                                                       throws NoSuchAlgorithmException

Generates a 256 bit HMAC SHA key with key ID "hmac".

Returns:

The HMAC SHA key.

Throws:

NoSuchAlgorithmException

generateSubjectEncryptionKey

protected static com.nimbusds.jose.jwk.OctetSequenceKey generateSubjectEncryptionKey()
                                                                              throws NoSuchAlgorithmException

Generates a 256 bit subject encryption key (intended for AES SIV mode) with key ID "subject-encrypt".

Returns:

The subject encryption key.

Throws:

NoSuchAlgorithmException

generateRotatingKeys

public List<com.nimbusds.jose.jwk.JWK> generateRotatingKeys(KeyIDs reservedKeyIDs,
                                                            boolean withMessage)
                                                     throws NoSuchAlgorithmException,
                                                            InvalidAlgorithmParameterException

Generates a new set of rotating signature and encryption keys for a Connect2id server.

Parameters:

reservedKeyIDs - The reserved key IDs, empty if none.

withMessage - If true a message will be printed to standard output.

Returns:

The generated rotating keys.

Throws:

NoSuchAlgorithmException

InvalidAlgorithmParameterException

generatePermanentKeys

public List<com.nimbusds.jose.jwk.JWK> generatePermanentKeys(boolean withMessage)
                                                      throws NoSuchAlgorithmException

Generates a new set of permanent keys for a Connect2id server.

Parameters:

withMessage - If true a message will be printed to standard output.

Returns:

The generated keys.

Throws:

NoSuchAlgorithmException

generate

public com.nimbusds.jose.jwk.JWKSet generate(boolean withMessage)
                                      throws NoSuchAlgorithmException,
                                             InvalidAlgorithmParameterException

Generates a new JWK set for a Connect2id server.

Parameters:

withMessage - If true a message will be printed to standard output.

Returns:

The JWK set.

Throws:

NoSuchAlgorithmException

InvalidAlgorithmParameterException

generateAndPrefixNewKeys

public com.nimbusds.jose.jwk.JWKSet generateAndPrefixNewKeys(com.nimbusds.jose.jwk.JWKSet oldJWKSet,
                                                             boolean withMessage)
                                                      throws Exception

A generates a new set of signing and encryption keys and prefixes them to the specified Connect2id server JWK set.

Parameters:

oldJWKSet - The Connect2id server JWK set. Must not be null.

withMessage - If true a message will be printed to std output.

Returns:

The updated JWK set.

Throws:

Exception

main

public static void main(String[] args)

Console method for generating a new Connect2id server JWK set, or updating an existing JWK set with new signing and encryption keys.

Parameters:

args - The command line arguments.