mirror of https://github.com/apache/activemq.git
[AMQ-9244] Add JWT authentication plugin
This commit is contained in:
JB Onofré
parent
52d70325ca
commit
8103ad959a
|
|
@ -66,6 +66,18 @@
|
|||
<artifactId>activemq-jaas</artifactId>
|
||||
<optional>true</optional>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.nimbusds</groupId>
|
||||
<artifactId>nimbus-jose-jwt</artifactId>
|
||||
<version>9.22</version>
|
||||
<optional>true</optional>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.bitbucket.b_c</groupId>
|
||||
<artifactId>jose4j</artifactId>
|
||||
<version>0.7.9</version>
|
||||
<optional>true</optional>
|
||||
</dependency>
|
||||
|
||||
<!-- =============================== -->
|
||||
<!-- Testing Dependencies -->
|
||||
|
|
|
|||
|
|
@ -0,0 +1,104 @@
|
|||
/**
|
||||
* Licensed to the Apache Software Foundation (ASF) under one or more
|
||||
* contributor license agreements. See the NOTICE file distributed with
|
||||
* this work for additional information regarding copyright ownership.
|
||||
* The ASF licenses this file to You under the Apache License, Version 2.0
|
||||
* (the "License"); you may not use this file except in compliance with
|
||||
* the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.apache.activemq.security.jwt;
|
||||
|
||||
import com.fasterxml.jackson.annotation.JsonValue;
|
||||
|
||||
import java.util.Set;
|
||||
|
||||
public enum Claims {
|
||||
|
||||
iss("Issuer", String.class),
|
||||
sub("Subject", String.class),
|
||||
exp("Expiration Time", Long.class),
|
||||
iat("Issued At Time", Long.class),
|
||||
jti("JWT ID", String.class),
|
||||
upn("JWT specific unique principal name", String.class),
|
||||
groups("JWT specific groups permission grant", Set.class),
|
||||
raw_token("JWT specific original bearer token", String.class),
|
||||
|
||||
aud("Audience", Set.class),
|
||||
nbf("Not Before", Long.class),
|
||||
auth_time("Time when the authentication occurred", Long.class),
|
||||
updated_at("Time the information was last updated", Long.class),
|
||||
azp("Authorized party - the party to which the ID Token was issued", String.class),
|
||||
nonce("Value used to associate a Client session with an ID Token", String.class),
|
||||
at_hash("Access Token hash value", Long.class),
|
||||
c_hash("Code hash value", Long.class),
|
||||
|
||||
full_name("Full name", String.class),
|
||||
family_name("Surname(s) or last name(s)", String.class),
|
||||
middle_name("Middle name(s)", String.class),
|
||||
nickname("Casual name", String.class),
|
||||
given_name("Given name(s) or first name(s)", String.class),
|
||||
preferred_username("Shorthand name by which the End-User wishes to be referred to", String.class),
|
||||
email("Preferred e-mail address", String.class),
|
||||
email_verified("True if the e-mail address has been verified; otherwise false", Boolean.class),
|
||||
|
||||
gender("Gender", String.class),
|
||||
birthdate("Birthday", String.class),
|
||||
zoneinfo("Time zone", String.class),
|
||||
locale("Locale", String.class),
|
||||
phone_number("Preferred telephone number", String.class),
|
||||
phone_number_verified("True if the phone number has been verified; otherwise false", Boolean.class),
|
||||
address("Preferred postal address", JsonValue.class),
|
||||
acr("Authentication Context Class Reference", String.class),
|
||||
amr("Authentication Methods References", String.class),
|
||||
sub_jwk("Public key used to check the signature of an ID Token", JsonValue.class),
|
||||
cnf("Confirmation", String.class),
|
||||
sip_from_tag("SIP From tag header field parameter value", String.class),
|
||||
sip_date("SIP Date header field value", String.class),
|
||||
sip_callid("SIP Call-Id header field value", String.class),
|
||||
sip_cseq_num("SIP CSeq numery header field parameter value", String.class),
|
||||
sip_via_branch("SIP Via branch header field parameter value", String.class),
|
||||
orig("Originating Identity String", String.class),
|
||||
dest("Destination Identity String", String.class),
|
||||
mky("Media Key Fingerprint String", String.class),
|
||||
|
||||
jwk("JSON Web Key Representing Public Key", JsonValue.class),
|
||||
jwe("Encrypted JSON Web Key", String.class),
|
||||
kid("Key identifier", String.class),
|
||||
jku("JWK Set URL", String.class),
|
||||
|
||||
UNKNOWN("A catch all for any unknown claim", Void.class)
|
||||
;
|
||||
|
||||
// @formatter:on
|
||||
private String description;
|
||||
private Class<?> type;
|
||||
|
||||
Claims(final String description, final Class<?> type) {
|
||||
this.description = description;
|
||||
this.type = type;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return A description for the claim
|
||||
*/
|
||||
public String getDescription() {
|
||||
return description;
|
||||
}
|
||||
|
||||
/**
|
||||
* The required type of the claim
|
||||
*
|
||||
* @return type of the claim
|
||||
*/
|
||||
public Class<?> getType() {
|
||||
return type;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,179 @@
|
|||
/**
|
||||
* Licensed to the Apache Software Foundation (ASF) under one or more
|
||||
* contributor license agreements. See the NOTICE file distributed with
|
||||
* this work for additional information regarding copyright ownership.
|
||||
* The ASF licenses this file to You under the Apache License, Version 2.0
|
||||
* (the "License"); you may not use this file except in compliance with
|
||||
* the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.apache.activemq.security.jwt;
|
||||
|
||||
import org.apache.activemq.broker.Broker;
|
||||
import org.apache.activemq.broker.ConnectionContext;
|
||||
import org.apache.activemq.command.ConnectionInfo;
|
||||
import org.apache.activemq.jaas.GroupPrincipal;
|
||||
import org.apache.activemq.security.AbstractAuthenticationBroker;
|
||||
import org.apache.activemq.security.SecurityContext;
|
||||
import org.jose4j.jwa.AlgorithmConstraints;
|
||||
import org.jose4j.jws.AlgorithmIdentifiers;
|
||||
import org.jose4j.jwt.JwtClaims;
|
||||
import org.jose4j.jwt.MalformedClaimException;
|
||||
import org.jose4j.jwt.consumer.InvalidJwtException;
|
||||
import org.jose4j.jwt.consumer.JwtConsumer;
|
||||
import org.jose4j.jwt.consumer.JwtConsumerBuilder;
|
||||
import org.jose4j.jwt.consumer.JwtContext;
|
||||
|
||||
import java.security.Key;
|
||||
import java.security.KeyFactory;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.security.Principal;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.spec.InvalidKeySpecException;
|
||||
import java.security.spec.X509EncodedKeySpec;
|
||||
import java.util.Base64;
|
||||
import java.util.Collections;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
/**
|
||||
* Handle authentication an user based on a JWT token
|
||||
*/
|
||||
public class JwtAuthenticationBroker extends AbstractAuthenticationBroker {
|
||||
|
||||
private final String jwtIssuer;
|
||||
private final Claims jwtGroupsClaim;
|
||||
private final String jwtValidatingPublicKey;
|
||||
|
||||
public JwtAuthenticationBroker(
|
||||
final Broker next,
|
||||
final String jwtIssuer,
|
||||
final Claims jwtGroupsClaim,
|
||||
final String jwtValidatingPublicKey) {
|
||||
super(next);
|
||||
this.jwtIssuer = jwtIssuer;
|
||||
this.jwtGroupsClaim = jwtGroupsClaim;
|
||||
this.jwtValidatingPublicKey = jwtValidatingPublicKey;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void addConnection(final ConnectionContext context, final ConnectionInfo info) throws Exception {
|
||||
SecurityContext securityContext = context.getSecurityContext();
|
||||
if (securityContext == null) {
|
||||
securityContext = authenticate(info.getUserName(), info.getPassword(), null);
|
||||
context.setSecurityContext(securityContext);
|
||||
securityContexts.add(securityContext);
|
||||
}
|
||||
|
||||
try {
|
||||
super.addConnection(context, info);
|
||||
} catch (Exception e) {
|
||||
securityContexts.remove(securityContext);
|
||||
context.setSecurityContext(null);
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public SecurityContext authenticate(final String username, final String password, final X509Certificate[] certificates) throws SecurityException {
|
||||
SecurityContext securityContext = null;
|
||||
if (!username.isEmpty()) {
|
||||
|
||||
// parse the JWT token and check signature, validity, nbf
|
||||
try {
|
||||
final JwtConsumerBuilder builder = new JwtConsumerBuilder()
|
||||
.setRelaxVerificationKeyValidation()
|
||||
.setRequireSubject()
|
||||
.setSkipDefaultAudienceValidation()
|
||||
.setRequireExpirationTime()
|
||||
.setExpectedIssuer(jwtIssuer)
|
||||
.setAllowedClockSkewInSeconds(5)
|
||||
.setVerificationKey(parsePCKS8(jwtValidatingPublicKey))
|
||||
.setJwsAlgorithmConstraints(
|
||||
new AlgorithmConstraints(AlgorithmConstraints.ConstraintType.WHITELIST,
|
||||
AlgorithmIdentifiers.RSA_USING_SHA256,
|
||||
AlgorithmIdentifiers.RSA_USING_SHA384,
|
||||
AlgorithmIdentifiers.RSA_USING_SHA512)
|
||||
);
|
||||
|
||||
final JwtConsumer jwtConsumer = builder.build();
|
||||
final JwtContext jwtContext = jwtConsumer.process(username);
|
||||
|
||||
// validate the JWT and process it to the claims
|
||||
jwtConsumer.processContext(jwtContext);
|
||||
final JwtClaims claimsSet = jwtContext.getJwtClaims();
|
||||
|
||||
// we have to determine the unique name to use as the principal name. It comes from upn, preferred_username, sub in that order
|
||||
String principalName = claimsSet.getClaimValue(Claims.upn.name(), String.class);
|
||||
if (principalName == null) {
|
||||
principalName = claimsSet.getClaimValue(Claims.preferred_username.name(), String.class);
|
||||
if (principalName == null) {
|
||||
principalName = claimsSet.getSubject();
|
||||
}
|
||||
}
|
||||
|
||||
final Set<String> groups = new HashSet<>();
|
||||
final List<String> globalGroups = claimsSet.getStringListClaimValue(jwtGroupsClaim.name());
|
||||
if (globalGroups != null) {
|
||||
groups.addAll(globalGroups);
|
||||
}
|
||||
|
||||
securityContext = new SecurityContext(principalName) {
|
||||
@Override
|
||||
public Set<Principal> getPrincipals() {
|
||||
return groups.stream().map(GroupPrincipal::new).collect(Collectors.toSet());
|
||||
}
|
||||
};
|
||||
} catch (final InvalidJwtException e) {
|
||||
throw new RuntimeException("Failed to verify token", e);
|
||||
} catch (final MalformedClaimException e) {
|
||||
throw new RuntimeException("Failed to verify token claims", e);
|
||||
}
|
||||
} else {
|
||||
// login as anonymous without any group or fail
|
||||
// or whatever logic you should apply when no credentials are available
|
||||
securityContext = new SecurityContext("anonymous") {
|
||||
@Override
|
||||
public Set<Principal> getPrincipals() {
|
||||
return Collections.emptySet();
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
return securityContext;
|
||||
}
|
||||
|
||||
private Key parsePCKS8(final String publicKey) {
|
||||
try {
|
||||
final X509EncodedKeySpec spec = new X509EncodedKeySpec(normalizeAndDecodePCKS8(publicKey));
|
||||
final KeyFactory kf = KeyFactory.getInstance("RSA");
|
||||
return kf.generatePublic(spec);
|
||||
} catch (final NoSuchAlgorithmException | InvalidKeySpecException | IllegalArgumentException e) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
private byte[] normalizeAndDecodePCKS8(final String publicKey) {
|
||||
if (publicKey.contains("PRIVATE KEY")) {
|
||||
throw new RuntimeException("Public Key is Private.");
|
||||
}
|
||||
|
||||
final String normalizedKey =
|
||||
publicKey.replaceAll("-----BEGIN (.*)-----", "")
|
||||
.replaceAll("-----END (.*)----", "")
|
||||
.replaceAll("\r\n", "")
|
||||
.replaceAll("\n", "");
|
||||
|
||||
return Base64.getDecoder().decode(normalizedKey);
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
/**
|
||||
* Licensed to the Apache Software Foundation (ASF) under one or more
|
||||
* contributor license agreements. See the NOTICE file distributed with
|
||||
* this work for additional information regarding copyright ownership.
|
||||
* The ASF licenses this file to You under the Apache License, Version 2.0
|
||||
* (the "License"); you may not use this file except in compliance with
|
||||
* the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.apache.activemq.security.jwt;
|
||||
|
||||
import com.nimbusds.jose.JWSAlgorithm;
|
||||
import org.apache.activemq.broker.Broker;
|
||||
import org.apache.activemq.broker.BrokerPlugin;
|
||||
|
||||
/**
|
||||
* A simple JWT plugin giving ActiveMQ the ability to support JWT tokens to authenticate and authorize users
|
||||
*
|
||||
* @org.apache.xbean.XBean element="jwtAuthenticationPlugin"
|
||||
* description="Provides a JWT authentication plugin"
|
||||
*
|
||||
*
|
||||
* This plugin is rather simple and is only meant to be used as a first step. In real world applications, we would need
|
||||
* to being able to specify different key format (RSA, DSA, EC, etc), the issuer, the claim to use for groups and maybe
|
||||
* some mapping functionalities.
|
||||
* The header name is also hard coded for simplicity.
|
||||
*/
|
||||
public class JwtAuthenticationPlugin implements BrokerPlugin {
|
||||
|
||||
public static final String JWT_ISSUER = "https://server.example.com";
|
||||
public static final Claims JWT_GROUPS_CLAIM = Claims.groups;
|
||||
public static final String JWT_SIGNING_KEY_LOCATION = "/privateKey.pem";
|
||||
public static final String JWT_VALIDATING_PUBLIC_KEY = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlivFI8qB4D0y2jy0" +
|
||||
"CfEqFyy46R0o7S8TKpsx5xbHKoU1VWg6QkQm+ntyIv1p4kE1sPEQO73+HY8+" +
|
||||
"Bzs75XwRTYL1BmR1w8J5hmjVWjc6R2BTBGAYRPFRhor3kpM6ni2SPmNNhurE" +
|
||||
"AHw7TaqszP5eUF/F9+KEBWkwVta+PZ37bwqSE4sCb1soZFrVz/UT/LF4tYpu" +
|
||||
"VYt3YbqToZ3pZOZ9AX2o1GCG3xwOjkc4x0W7ezbQZdC9iftPxVHR8irOijJR" +
|
||||
"RjcPDtA6vPKpzLl6CyYnsIYPd99ltwxTHjr3npfv/3Lw50bAkbT4HeLFxTx4" +
|
||||
"flEoZLKO/g0bAoV2uqBhkA9xnQIDAQAB";
|
||||
public static final JWSAlgorithm JWT_SIGNING_ALGO = JWSAlgorithm.RS256;
|
||||
public static final String JWT_HEADER = "Authorization";
|
||||
|
||||
public JwtAuthenticationPlugin() {
|
||||
}
|
||||
|
||||
public Broker installPlugin(final Broker next) {
|
||||
|
||||
// the public key is hard coded here for the sake of the example
|
||||
return new JwtAuthenticationBroker(next, JWT_ISSUER, JWT_GROUPS_CLAIM, JWT_VALIDATING_PUBLIC_KEY);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,157 @@
|
|||
/**
|
||||
* Licensed to the Apache Software Foundation (ASF) under one or more
|
||||
* contributor license agreements. See the NOTICE file distributed with
|
||||
* this work for additional information regarding copyright ownership.
|
||||
* The ASF licenses this file to You under the Apache License, Version 2.0
|
||||
* (the "License"); you may not use this file except in compliance with
|
||||
* the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.apache.activemq.security.jwt;
|
||||
|
||||
import com.nimbusds.jose.JOSEObjectType;
|
||||
import com.nimbusds.jose.JWSHeader;
|
||||
import com.nimbusds.jose.crypto.RSASSASigner;
|
||||
import com.nimbusds.jose.shaded.json.JSONObject;
|
||||
import com.nimbusds.jwt.JWTClaimsSet;
|
||||
import com.nimbusds.jwt.SignedJWT;
|
||||
|
||||
import java.io.InputStream;
|
||||
import java.security.KeyFactory;
|
||||
import java.security.KeyPair;
|
||||
import java.security.KeyPairGenerator;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.security.PrivateKey;
|
||||
import java.security.PublicKey;
|
||||
import java.security.spec.PKCS8EncodedKeySpec;
|
||||
import java.security.spec.X509EncodedKeySpec;
|
||||
import java.util.Base64;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* Utilities for generating a JWT for testing
|
||||
*/
|
||||
public class TokenUtils {
|
||||
|
||||
private TokenUtils() {}
|
||||
|
||||
/**
|
||||
* Read a PEM encoded private key from the classpath.
|
||||
*
|
||||
* @param pemResName key file resource name
|
||||
* @return the PrivateKey
|
||||
* @throws Exception on decode failure
|
||||
*/
|
||||
public static PrivateKey readPrivateKey(String pemResName) throws Exception {
|
||||
InputStream contentIS = TokenUtils.class.getResourceAsStream(pemResName);
|
||||
byte[] tmp = new byte[4096];
|
||||
int length = contentIS.read(tmp);
|
||||
return decodePrivateKey(new String(tmp, 0, length));
|
||||
}
|
||||
|
||||
/**
|
||||
* Read a PEM encoded public key from the classpath.
|
||||
*
|
||||
* @param pemResName key file resource name
|
||||
* @return the PublicKey
|
||||
* @throws Exception on decode failure
|
||||
*/
|
||||
public static PublicKey readPublicKey(String pemResName) throws Exception {
|
||||
InputStream contentIS = TokenUtils.class.getResourceAsStream(pemResName);
|
||||
byte[] tmp = new byte[4096];
|
||||
int length = contentIS.read(tmp);
|
||||
return decodePublicKey(new String(tmp, 0, length));
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a new RSA keypair.
|
||||
*
|
||||
* @param keySize the size of the key
|
||||
* @return the KeyPair
|
||||
* @throws NoSuchAlgorithmException on failure to load RSA key generator
|
||||
*/
|
||||
public static KeyPair generateKeyPair(int keySize) throws NoSuchAlgorithmException {
|
||||
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
|
||||
keyPairGenerator.initialize(keySize);
|
||||
return keyPairGenerator.genKeyPair();
|
||||
}
|
||||
|
||||
/**
|
||||
* Decode a PEM encoded private key string to a RSA PrivateKey.
|
||||
*
|
||||
* @param pemEncoded PEM string for private key
|
||||
* @return the PrivateKey
|
||||
* @throws Exception on decode failure
|
||||
*/
|
||||
public static PrivateKey decodePrivateKey(String pemEncoded) throws Exception {
|
||||
pemEncoded = removeBeginEnd(pemEncoded);
|
||||
byte[] pkcs8EncodedBytes = Base64.getDecoder().decode(pemEncoded);
|
||||
// extract the private key
|
||||
PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(pkcs8EncodedBytes);
|
||||
KeyFactory kf = KeyFactory.getInstance("RSA");
|
||||
return kf.generatePrivate(keySpec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Decode a PEM encoded public key string to a RSA PublicKey
|
||||
*
|
||||
* @param pemEncoded PEM string for public key
|
||||
* @return the PublicKey
|
||||
* @throws Exception on decode failure
|
||||
*/
|
||||
public static PublicKey decodePublicKey(String pemEncoded) throws Exception {
|
||||
pemEncoded = removeBeginEnd(pemEncoded);
|
||||
byte[] encodedBytes = Base64.getDecoder().decode(pemEncoded);
|
||||
// extract the public key
|
||||
X509EncodedKeySpec keySpec = new X509EncodedKeySpec(encodedBytes);
|
||||
KeyFactory kf = KeyFactory.getInstance("RSA");
|
||||
return kf.generatePublic(keySpec);
|
||||
}
|
||||
|
||||
private static String removeBeginEnd(String pem) {
|
||||
pem = pem.replaceAll("-----BEGIN (.*)-----", "");
|
||||
pem = pem.replaceAll("-----END (.*)----", "");
|
||||
pem = pem.replaceAll("\r\n", "");
|
||||
pem = pem.replaceAll("\n", "");
|
||||
return pem.trim();
|
||||
}
|
||||
|
||||
public static String token(final String name, final List<String> groups) {
|
||||
final JSONObject claims = new JSONObject();
|
||||
|
||||
claims.put(Claims.iss.name(), JwtAuthenticationPlugin.JWT_ISSUER);
|
||||
long currentTimeInSecs = System.currentTimeMillis() / 1000;
|
||||
claims.put(Claims.iat.name(), currentTimeInSecs);
|
||||
claims.put(Claims.auth_time.name(), currentTimeInSecs);
|
||||
claims.put(Claims.exp.name(), currentTimeInSecs + 300);
|
||||
claims.put(Claims.jti.name(), "a-123");
|
||||
claims.put(Claims.sub.name(), "24400320");
|
||||
claims.put(Claims.preferred_username.name(), name);
|
||||
claims.put(Claims.aud.name(), "s6BhdRkqt3");
|
||||
claims.put(Claims.groups.name(), groups);
|
||||
|
||||
try {
|
||||
final PrivateKey pk = readPrivateKey(JwtAuthenticationPlugin.JWT_SIGNING_KEY_LOCATION);
|
||||
final JWSHeader header = new JWSHeader.Builder(JwtAuthenticationPlugin.JWT_SIGNING_ALGO)
|
||||
.keyID(JwtAuthenticationPlugin.JWT_SIGNING_KEY_LOCATION)
|
||||
.type(JOSEObjectType.JWT)
|
||||
.build();
|
||||
|
||||
final JWTClaimsSet claimsSet = JWTClaimsSet.parse(claims);
|
||||
final SignedJWT jwt = new SignedJWT(header, claimsSet);
|
||||
jwt.sign(new RSASSASigner(pk));
|
||||
return jwt.serialize();
|
||||
|
||||
} catch (final Exception e) {
|
||||
throw new RuntimeException("Could not sign JWT");
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue