org.apache.kafka.common.security.oauthbearer.secured

Class JwksFileVerificationKeyResolver

java.lang.Object

org.apache.kafka.common.security.oauthbearer.secured.JwksFileVerificationKeyResolver

All Implemented Interfaces:

Closeable, AutoCloseable, CloseableVerificationKeyResolver, Initable, org.jose4j.keys.resolvers.VerificationKeyResolver

public class JwksFileVerificationKeyResolver
extends Object
implements CloseableVerificationKeyResolver

JwksFileVerificationKeyResolver is a VerificationKeyResolver implementation that will load the JWKS from the given file system directory. A JWKS (JSON Web Key Set) is a JSON document provided by the OAuth/OIDC provider that lists the keys used to sign the JWTs it issues. Here is a sample JWKS JSON document:

 {
   "keys": [
     {
       "kty": "RSA",
       "alg": "RS256",
       "kid": "abc123",
       "use": "sig",
       "e": "AQAB",
       "n": "..."
     },
     {
       "kty": "RSA",
       "alg": "RS256",
       "kid": "def456",
       "use": "sig",
       "e": "AQAB",
       "n": "..."
     }
   ]
 }
 

Without going into too much detail, the array of keys enumerates the key data that the provider is using to sign the JWT. The key ID (kid) is referenced by the JWT's header in order to match up the JWT's signing key with the key in the JWKS. During the validation step of the broker, the jose4j OAuth library will use the contents of the appropriate key in the JWKS to validate the signature. Given that the JWKS is referenced by the JWT, the JWKS must be made available by the OAuth/OIDC provider so that a JWT can be validated.

See Also:

SaslConfigs.SASL_OAUTHBEARER_TOKEN_ENDPOINT_URL, VerificationKeyResolver

Constructor Summary

Constructors

Constructor and Description
JwksFileVerificationKeyResolver(Path jwksFile)

Method Summary

Modifier and Type	Method and Description
void	init() Lifecycle method to perform any one-time initialization of the retriever.
Key	resolveKey(org.jose4j.jws.JsonWebSignature jws, List<org.jose4j.jwx.JsonWebStructure> nestingContext)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.kafka.common.security.oauthbearer.secured.CloseableVerificationKeyResolver

close

Constructor Detail

JwksFileVerificationKeyResolver

public JwksFileVerificationKeyResolver(Path jwksFile)

Method Detail

init

public void init()
          throws IOException

Description copied from interface: Initable

Lifecycle method to perform any one-time initialization of the retriever. This must be performed by the caller to ensure the correct state before methods are invoked.

Specified by:

init in interface Initable

Throws:

IOException - Thrown on errors related to IO during initialization

resolveKey

public Key resolveKey(org.jose4j.jws.JsonWebSignature jws,
                      List<org.jose4j.jwx.JsonWebStructure> nestingContext)
               throws org.jose4j.lang.UnresolvableKeyException

Specified by:

resolveKey in interface org.jose4j.keys.resolvers.VerificationKeyResolver

Throws:

org.jose4j.lang.UnresolvableKeyException