org.apache.kafka.common.security.oauthbearer.secured

Class RefreshingHttpsJwksVerificationKeyResolver

java.lang.Object

org.apache.kafka.common.security.oauthbearer.secured.RefreshingHttpsJwksVerificationKeyResolver

All Implemented Interfaces:

Closeable, AutoCloseable, CloseableVerificationKeyResolver, Initable, org.jose4j.keys.resolvers.VerificationKeyResolver

public class RefreshingHttpsJwksVerificationKeyResolver
extends Object
implements CloseableVerificationKeyResolver

RefreshingHttpsJwksVerificationKeyResolver is a VerificationKeyResolver implementation that will periodically refresh the JWKS using its HttpsJwks instance. A JWKS (JSON Web Key Set) is a JSON document provided by the OAuth/OIDC provider that lists the keys used to sign the JWTs it issues. Here is a sample JWKS JSON document:

 {
   "keys": [
     {
       "kty": "RSA",
       "alg": "RS256",
       "kid": "abc123",
       "use": "sig",
       "e": "AQAB",
       "n": "..."
     },
     {
       "kty": "RSA",
       "alg": "RS256",
       "kid": "def456",
       "use": "sig",
       "e": "AQAB",
       "n": "..."
     }
   ]
 }
 

Without going into too much detail, the array of keys enumerates the key data that the provider is using to sign the JWT. The key ID (kid) is referenced by the JWT's header in order to match up the JWT's signing key with the key in the JWKS. During the validation step of the broker, the jose4j OAuth library will use the contents of the appropriate key in the JWKS to validate the signature. Given that the JWKS is referenced by the JWT, the JWKS must be made available by the OAuth/OIDC provider so that a JWT can be validated.

See Also:

CloseableVerificationKeyResolver, VerificationKeyResolver, RefreshingHttpsJwks, HttpsJwks

Constructor Summary

Constructors

Constructor and Description
RefreshingHttpsJwksVerificationKeyResolver(RefreshingHttpsJwks refreshingHttpsJwks)

Method Summary

Modifier and Type	Method and Description
void	close() Lifecycle method to perform a clean shutdown of the VerificationKeyResolver.
void	init() Lifecycle method to perform any one-time initialization of the retriever.
Key	resolveKey(org.jose4j.jws.JsonWebSignature jws, List<org.jose4j.jwx.JsonWebStructure> nestingContext)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

RefreshingHttpsJwksVerificationKeyResolver

public RefreshingHttpsJwksVerificationKeyResolver(RefreshingHttpsJwks refreshingHttpsJwks)

Method Detail

init

public void init()
          throws IOException

Description copied from interface: Initable

Lifecycle method to perform any one-time initialization of the retriever. This must be performed by the caller to ensure the correct state before methods are invoked.

Specified by:

init in interface Initable

Throws:

IOException - Thrown on errors related to IO during initialization

close

public void close()

Description copied from interface: CloseableVerificationKeyResolver

Lifecycle method to perform a clean shutdown of the VerificationKeyResolver. This must be performed by the caller to ensure the correct state, freeing up and releasing any resources performed in Initable.init().

Specified by:

close in interface Closeable

Specified by:

close in interface AutoCloseable

Specified by:

close in interface CloseableVerificationKeyResolver

resolveKey

public Key resolveKey(org.jose4j.jws.JsonWebSignature jws,
                      List<org.jose4j.jwx.JsonWebStructure> nestingContext)
               throws org.jose4j.lang.UnresolvableKeyException

Specified by:

resolveKey in interface org.jose4j.keys.resolvers.VerificationKeyResolver

Throws:

org.jose4j.lang.UnresolvableKeyException