Package org.apache.juneau.rest.server.auth.oidc.rp

Class IdTokenValidatorAdapter

java.lang.Object

org.apache.juneau.rest.server.auth.oidc.rp.IdTokenValidatorAdapter

public class IdTokenValidatorAdapter
extends Object

Wraps Nimbus's IDTokenValidator to validate an OpenID Connect ID token's signature and claims and project the verified claims onto a Juneau ClaimsPrincipal.

Nimbus's IDTokenValidator performs the full OIDC ID-token validation in one call: signature verification against the IdP JWKS, exact iss match, aud contains the client id, azp when there are multiple audiences, exp (with clock skew), required iat, and — when supplied — nonce match. This adapter owns only the configuration and the projection to ClaimsPrincipal; no bespoke crypto.

The signing-algorithm allowlist defaults to [RS256, ES256] (both SHA-256 based). The unsafe "none" algorithm is permanently rejected (a token signed with none has no key and so fails the key selector), and SHA-1-family algorithms are excluded by virtue of not being on the allowlist — consistent with the juneau-rest-server-auth-jwt strict-default stance.

For production, configure IdTokenValidatorAdapter.Builder.jwksUri(URI) (Nimbus builds a cached remote key source). For tests / HSM-backed signers / multi-issuer setups, inject a IdTokenValidatorAdapter.Builder.jwkSet(JWKSet) or IdTokenValidatorAdapter.Builder.jwkSource(JWKSource) directly.

Since:

10.0.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	IdTokenValidatorAdapter.Builder	Builder.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	IdTokenValidatorAdapter(IdTokenValidatorAdapter.Builder b)	Constructor.

Method Summary

Modifier and Type	Method	Description
static IdTokenValidatorAdapter.Builder	create()	Static creator.
ClaimsPrincipal	validate(String idToken, String expectedNonce)	Validates an ID token and projects the verified claims onto a ClaimsPrincipal.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

IdTokenValidatorAdapter

protected IdTokenValidatorAdapter(IdTokenValidatorAdapter.Builder b)

Constructor.

Parameters:

b - The builder.

Method Details

create

public static IdTokenValidatorAdapter.Builder create()

Static creator.

Returns:

A new builder.

validate

public ClaimsPrincipal validate(String idToken,
 String expectedNonce)
                         throws AuthenticationException

Validates an ID token and projects the verified claims onto a ClaimsPrincipal.

Parameters:

idToken - The raw (compact) ID token JWT. Must not be null or blank.

expectedNonce - The nonce the relying party stored before the redirect; the ID token's nonce claim must match. May be null only if the flow did not use a nonce (the RP always supplies one).

Returns:

The verified claims as a ClaimsPrincipal whose name is the sub claim.

Throws:

AuthenticationException - If parsing, signature verification, or any claim check fails.