software.sandc.springframework.security.jwt.impl.consumer

Class DefaultJWTConsumer

java.lang.Object

software.sandc.springframework.security.jwt.impl.consumer.DefaultJWTConsumer

All Implemented Interfaces:

org.springframework.beans.factory.InitializingBean, JWTConsumer

Direct Known Subclasses:

DefaultJWTAuthority

public class DefaultJWTConsumer
extends Object
implements JWTConsumer, org.springframework.beans.factory.InitializingBean

Field Summary

Fields

Modifier and Type	Field and Description
protected String	authoritiesParameterName
protected JWTAuthorityConnector	jwtAuthorityConnector
protected JWTRequestResponseHandler	jwtRequestResponseHandler
protected String	sessionIdParameterName
protected io.jsonwebtoken.SigningKeyResolver	signingKeyResolver
static String	SPRING_SECURITY_JWT_AUTHORITIES_PARAMETER_NAME
static String	SPRING_SECURITY_JWT_SESSION_ID_PARAMETER_NAME
static String	SPRING_SECURITY_JWT_XSRF_PARAMETER_NAME
protected static Integer	TEN_YEARS_IN_SECONDS
protected String	xsrfParameterName

Constructor Summary

Constructors

Constructor and Description
DefaultJWTConsumer()
DefaultJWTConsumer(JWTAuthorityConnector jwtAuthorityConnector)

Method Summary

Modifier and Type	Method and Description
void	afterPropertiesSet()
JWTContext	authenticateJWTRequest(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Authenticate HTTP request if the request contains JWT and related tokens are valid. The created JWTAuthentication object (which is also the part of JWTContext) is implicitly attached into SecurityContextHolder to inform spring security about the authenticated user.
protected JWTContext	createJWTContext(String principal, String sessionId, String xsrfToken, Collection<? extends org.springframework.security.core.GrantedAuthority> authorities, String jwtMode, String jwtToken)
protected String	extractPrincipal(io.jsonwebtoken.Claims claims)
protected String	extractSessionId(io.jsonwebtoken.Claims claims)
protected Collection<org.springframework.security.core.GrantedAuthority>	getAuthorities(io.jsonwebtoken.Claims claims)
protected String	getJWTModeFromParameters(Parameters parameters)
JWTRequestResponseHandler	getJwtRequestResponseHandler()
protected void	handleJWTContext(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, JWTContext jwtContext)
void	setAuthoritiesParameterName(String authoritiesParameterName)
void	setJWTAuthorityConnector(JWTAuthorityConnector jwtAuthorityConnector)
void	setJwtRequestResponseHandler(JWTRequestResponseHandler jwtRequestResponseHandler)
void	setSessionIdParameterName(String sessionIdParameterName)
void	setSigningKeyResolver(io.jsonwebtoken.SigningKeyResolver signingKeyResolver)
void	setXsrfParameterName(String xsrfParameterName)
JWTContext	validate(TokenContainer tokenContainer, Parameters parameters) Validate tokens given in a TokenContainer instance.
protected void	validateXSRF(io.jsonwebtoken.Claims claims, String xsrfToken)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

TEN_YEARS_IN_SECONDS

protected static final Integer TEN_YEARS_IN_SECONDS

SPRING_SECURITY_JWT_XSRF_PARAMETER_NAME

public static final String SPRING_SECURITY_JWT_XSRF_PARAMETER_NAME

See Also:

Constant Field Values

SPRING_SECURITY_JWT_SESSION_ID_PARAMETER_NAME

public static final String SPRING_SECURITY_JWT_SESSION_ID_PARAMETER_NAME

See Also:

Constant Field Values

SPRING_SECURITY_JWT_AUTHORITIES_PARAMETER_NAME

public static final String SPRING_SECURITY_JWT_AUTHORITIES_PARAMETER_NAME

See Also:

Constant Field Values

authoritiesParameterName

protected String authoritiesParameterName

sessionIdParameterName

protected String sessionIdParameterName

xsrfParameterName

protected String xsrfParameterName

jwtAuthorityConnector

protected JWTAuthorityConnector jwtAuthorityConnector

signingKeyResolver

protected io.jsonwebtoken.SigningKeyResolver signingKeyResolver

jwtRequestResponseHandler

protected JWTRequestResponseHandler jwtRequestResponseHandler

Constructor Detail

DefaultJWTConsumer

public DefaultJWTConsumer()

DefaultJWTConsumer

public DefaultJWTConsumer(JWTAuthorityConnector jwtAuthorityConnector)

Method Detail

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

Specified by:

afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

Throws:

Exception

authenticateJWTRequest

public JWTContext authenticateJWTRequest(javax.servlet.http.HttpServletRequest request,
                                         javax.servlet.http.HttpServletResponse response)

Description copied from interface: JWTConsumer

Authenticate HTTP request if the request contains JWT and related tokens are valid.

The created JWTAuthentication object (which is also the part of JWTContext) is implicitly attached into SecurityContextHolder to inform spring security about the authenticated user.

Specified by:

authenticateJWTRequest in interface JWTConsumer

Parameters:

request - HTTP request

response - HTTP response

Returns:

A fully fledged JWTContext object.

validate

public JWTContext validate(TokenContainer tokenContainer,
                           Parameters parameters)
                    throws InvalidTokenException,
                           ExpiredTokenException

Description copied from interface: JWTConsumer

Validate tokens given in a TokenContainer instance. Validation procedure checks both JWT integrity and also XSRF (a.k.a CSRF) token validity.

Specified by:

validate in interface JWTConsumer

Parameters:

tokenContainer - TokenContainer instance which contains JWT and XSRF tokens.

parameters - Additional parameters to customize processing of the request. Possible parameters and their effects may differ depending on specific implementation. The parameters may be empty or null.

Returns:

A fully fledged JWTContext object.

Throws:

InvalidTokenException - if the token is not valid or its integrity is not ensured.

ExpiredTokenException - if the token is expired.

setSigningKeyResolver

public void setSigningKeyResolver(io.jsonwebtoken.SigningKeyResolver signingKeyResolver)

setJWTAuthorityConnector

public void setJWTAuthorityConnector(JWTAuthorityConnector jwtAuthorityConnector)

setJwtRequestResponseHandler

public void setJwtRequestResponseHandler(JWTRequestResponseHandler jwtRequestResponseHandler)

getJwtRequestResponseHandler

public JWTRequestResponseHandler getJwtRequestResponseHandler()

setAuthoritiesParameterName

public void setAuthoritiesParameterName(String authoritiesParameterName)

setXsrfParameterName

public void setXsrfParameterName(String xsrfParameterName)

setSessionIdParameterName

public void setSessionIdParameterName(String sessionIdParameterName)

handleJWTContext

protected void handleJWTContext(javax.servlet.http.HttpServletRequest request,
                                javax.servlet.http.HttpServletResponse response,
                                JWTContext jwtContext)

validateXSRF

protected void validateXSRF(io.jsonwebtoken.Claims claims,
                            String xsrfToken)

extractPrincipal

protected String extractPrincipal(io.jsonwebtoken.Claims claims)

extractSessionId

protected String extractSessionId(io.jsonwebtoken.Claims claims)

getAuthorities

protected Collection<org.springframework.security.core.GrantedAuthority> getAuthorities(io.jsonwebtoken.Claims claims)

createJWTContext

protected JWTContext createJWTContext(String principal,
                                      String sessionId,
                                      String xsrfToken,
                                      Collection<? extends org.springframework.security.core.GrantedAuthority> authorities,
                                      String jwtMode,
                                      String jwtToken)

getJWTModeFromParameters

protected String getJWTModeFromParameters(Parameters parameters)