org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider Java Examples

The following examples show how to use org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example #1

Source File: DefaultJoseImpl.java From thorntail with Apache License 2.0

6 votes

@Override
public String sign(SignatureInput input) {
    JwsHeaders headers = new JwsHeaders();
    headers.asMap().putAll(input.getHeaders());
    if (!config.signatureDataEncoding()) {
        headers.setPayloadEncodingStatus(false);
    }
    if (config.includeSignatureKeyAlias()) {
        headers.setKeyId(signatureKeyAlias());
    }
    Properties props = prepareSignatureVerificationProperties(JoseOperation.SIGN);
    headers.setSignatureAlgorithm(SignatureAlgorithm.getAlgorithm(config.signatureAlgorithm()));
    JwsSignatureProvider provider = getSignatureProvider(props, headers);

    return DEFAULT_JOSE_FORMAT == config.signatureFormat()
            ? signCompact(provider, headers, input.getData()) : signJson(provider, headers, input.getData());
}

Example #2

Source File: TestJwts.java From deprecated-security-advanced-modules with Apache License 2.0

5 votes

static String createSignedWithPeculiarEscaping(JwtToken baseJwt, JsonWebKey jwk) {
	JwsSignatureProvider signatureProvider = JwsUtils.getSignatureProvider(jwk);
	JwsHeaders jwsHeaders = new JwsHeaders();
	JwtToken signedToken = new JwtToken(jwsHeaders, baseJwt.getClaims());

	// Depends on CXF not escaping the input string. This may fail for other frameworks or versions.
	jwsHeaders.setKeyId(jwk.getKeyId().replace("/", "\\/"));

	return new JoseJwtProducer().processJwt(signedToken, null, signatureProvider);
}

Example #3

Source File: AbstractJoseProducer.java From cxf with Apache License 2.0

5 votes

protected JwsSignatureProvider getInitializedSignatureProvider(JwsHeaders jwsHeaders) {
    if (sigProvider != null) {
        return sigProvider;
    }

    return JwsUtils.loadSignatureProvider(jwsHeaders, false);
}

Example #4

Source File: JoseProducer.java From cxf with Apache License 2.0

5 votes

public String processData(String data) {
    super.checkProcessRequirements();
    
    JweEncryptionProvider theEncProvider = null;
    JweHeaders jweHeaders = new JweHeaders();
    if (isJweRequired()) {
        theEncProvider = getInitializedEncryptionProvider(jweHeaders);
        if (theEncProvider == null) {
            throw new JoseException("Unable to encrypt the data");
        }
    }

    if (isJwsRequired()) {
        JwsHeaders jwsHeaders = new JwsHeaders();
        JwsCompactProducer jws = new JwsCompactProducer(jwsHeaders, data);
        
        JwsSignatureProvider theSigProvider = getInitializedSignatureProvider(jwsHeaders);
        
        if (theSigProvider == null) {
            throw new JoseException("Unable to sign the data");
        }

        data = jws.signWith(theSigProvider);
        
    }
    if (theEncProvider != null) {
        data = theEncProvider.encrypt(StringUtils.toBytesUTF8(data), jweHeaders);
    }
    return data;
}

Example #5

Source File: JoseJwtProducer.java From cxf with Apache License 2.0

5 votes

public String processJwt(JwtToken jwt,
                            JweEncryptionProvider theEncProvider,
                            JwsSignatureProvider theSigProvider) {
    super.checkProcessRequirements();
    String data = null;

    if (isJweRequired() && theEncProvider == null) {
        theEncProvider = getInitializedEncryptionProvider(jwt.getJweHeaders());
        if (theEncProvider == null) {
            throw new JwtException("Unable to encrypt JWT");
        }
    }

    if (isJwsRequired()) {
        
        JwsJwtCompactProducer jws = new JwsJwtCompactProducer(jwt);
        if (jws.isPlainText()) {
            data = jws.getSignedEncodedJws();
        } else {
            if (theSigProvider == null) {
                theSigProvider = getInitializedSignatureProvider(jws.getJwsHeaders());
            }

            if (theSigProvider == null) {
                throw new JwtException("Unable to sign JWT");
            }

            data = jws.signWith(theSigProvider);
        }
        if (theEncProvider != null) {
            data = theEncProvider.encrypt(StringUtils.toBytesUTF8(data), jwt.getJweHeaders());
        }
    } else {
        JweJwtCompactProducer jwe = new JweJwtCompactProducer(jwt.getJweHeaders(), jwt.getClaims());
        data = jwe.encryptWith(theEncProvider);
    }
    return data;
}

Example #6

Source File: AbstractJwsJsonWriterProvider.java From cxf with Apache License 2.0

5 votes

protected List<JwsSignatureProvider> getInitializedSigProviders(
    List<String> propLocs, List<JwsHeaders> protectedHeaders) {
    if (sigProviders != null) {
        return sigProviders;
    }
    Message m = JAXRSUtils.getCurrentMessage();
    List<JwsSignatureProvider> theSigProviders = new LinkedList<>();
    for (int i = 0; i < propLocs.size(); i++) {
        Properties props = JwsUtils.loadJwsProperties(m, propLocs.get(i));
        theSigProviders.add(JwsUtils.loadSignatureProvider(props, protectedHeaders.get(i)));
    }
    return theSigProviders;
}

Example #7

Source File: AbstractJwsWriterProvider.java From cxf with Apache License 2.0

5 votes

protected void writeJws(JwsCompactProducer p, JwsSignatureProvider theSigProvider, OutputStream os)
    throws IOException {
    p.signWith(theSigProvider);
    JoseUtils.traceHeaders(p.getJwsHeaders());
    byte[] bytes = StringUtils.toBytesUTF8(p.getSignedEncodedJws());
    IOUtils.copy(new ByteArrayInputStream(bytes), os);
}

Example #8

Source File: AbstractJwsWriterProvider.java From cxf with Apache License 2.0

5 votes

protected JwsSignatureProvider getInitializedSigProvider(JwsHeaders headers) {
    setRequestContextProperty(headers);
    if (sigProvider != null) {
        return sigProvider;
    }
    return JwsUtils.loadSignatureProvider(headers, true);
}

Example #9

Source File: AbstractJwsMultipartSignatureFilter.java From cxf with Apache License 2.0

5 votes

protected List<Object> getAttachmentParts(Object rootEntity) {
    List<Object> parts = null;
    
    if (rootEntity instanceof MultipartBody) {
        parts = CastUtils.cast(((MultipartBody)rootEntity).getAllAttachments());
    } else {
        parts = new ArrayList<>();
        if (rootEntity instanceof List) {
            List<Object> entityList = CastUtils.cast((List<?>)rootEntity);
            parts.addAll(entityList);
        } else {
            parts.add(rootEntity);
        }
    }
    
    JwsHeaders headers = new JwsHeaders();
    headers.setPayloadEncodingStatus(false);
    JwsSignatureProvider theSigProvider = sigProvider != null ? sigProvider
        : JwsUtils.loadSignatureProvider(headers, true);
    JwsSignature jwsSignature = theSigProvider.createJwsSignature(headers);
    
    String base64UrlEncodedHeaders = Base64UrlUtility.encode(writer.toJson(headers));
    byte[] headerBytesWithDot = StringUtils.toBytesASCII(base64UrlEncodedHeaders + ".");
    jwsSignature.update(headerBytesWithDot, 0, headerBytesWithDot.length);
    AttachmentUtils.addMultipartOutFilter(new JwsMultipartSignatureOutFilter(jwsSignature));
    
    
    JwsDetachedSignature jws = new JwsDetachedSignature(headers, 
                                                        base64UrlEncodedHeaders,
                                                        jwsSignature,
                                                        useJwsJsonSignatureFormat);
    
    Attachment jwsPart = new Attachment("signature", JoseConstants.MEDIA_TYPE_JOSE, jws);
    parts.add(jwsPart);
    return parts;
}

Example #10

Source File: JwsJsonWriterInterceptor.java From cxf with Apache License 2.0

5 votes

private void prepareProtectedHeader(JwsHeaders headers,
                                    WriterInterceptorContext ctx,
                                    JwsSignatureProvider signer,
                                    boolean protectHttp) {
    headers.setSignatureAlgorithm(signer.getAlgorithm());
    setContentTypeIfNeeded(headers, ctx);
    if (!encodePayload) {
        headers.setPayloadEncodingStatus(false);
    }
    if (protectHttp) {
        protectHttpHeadersIfNeeded(ctx, headers);
    }
}

Example #11

Source File: AbstractOAuthDataProviderTest.java From cxf with Apache License 2.0

5 votes

protected static void initializeProvider(AbstractOAuthDataProvider dataProvider) {
    dataProvider.setSupportedScopes(Collections.singletonMap("a", "A Scope"));
    dataProvider.setSupportedScopes(Collections.singletonMap("refreshToken", "RefreshToken"));

    // Configure the means of signing the issued JWT tokens
    if (dataProvider.isUseJwtFormatForAccessTokens()) {
        final JwsSignatureProvider signatureProvider =
            new PrivateKeyJwsSignatureProvider(keyPair.getPrivate(), SignatureAlgorithm.RS256);

        OAuthJoseJwtProducer jwtAccessTokenProducer = new OAuthJoseJwtProducer();
        jwtAccessTokenProducer.setSignatureProvider(signatureProvider);
        dataProvider.setJwtAccessTokenProducer(jwtAccessTokenProducer);
    }
}

Example #12

Source File: JoseSessionTokenProvider.java From cxf with Apache License 2.0

5 votes

private String protectStateString(String stateString) {
    JwsSignatureProvider jws = getInitializedSigProvider();
    JweEncryptionProvider jwe = getInitializedEncryptionProvider();
    if (jws == null && jwe == null) {
        throw new OAuthServiceException("Session token can not be created");
    }
    if (jws != null) {
        stateString = JwsUtils.sign(jws, stateString, null);
    }
    if (jwe != null) {
        stateString = jwe.encrypt(StringUtils.toBytesUTF8(stateString), null);
    }
    return stateString;
}

Example #13

Source File: JoseClientCodeStateManager.java From cxf with Apache License 2.0

5 votes

protected JwsSignatureProvider getInitializedSigProvider(JweEncryptionProvider theEncryptionProvider) {
    if (sigProvider != null) {
        return sigProvider;
    }
    JwsSignatureProvider theSigProvider = JwsUtils.loadSignatureProvider(false);
    if (theSigProvider == null && theEncryptionProvider != null) {
        theSigProvider = new NoneJwsSignatureProvider();
    }
    return theSigProvider;
}

Example #14

Source File: JoseClientCodeStateManager.java From cxf with Apache License 2.0

5 votes

@Override
public MultivaluedMap<String, String> toRedirectState(MessageContext mc,
                                                      MultivaluedMap<String, String> requestState) {
    JweEncryptionProvider theEncryptionProvider = getInitializedEncryptionProvider();
    JwsSignatureProvider theSigProvider = getInitializedSigProvider(theEncryptionProvider);
    if (theEncryptionProvider == null && theSigProvider == null) {
        throw new OAuthServiceException("The state can not be protected");
    }
    MultivaluedMap<String, String> redirectMap = new MetadataMap<>();

    if (generateNonce && theSigProvider != null) {
        JwsCompactProducer nonceProducer = new JwsCompactProducer(OAuthUtils.generateRandomTokenKey());
        String nonceParam = nonceProducer.signWith(theSigProvider);
        requestState.putSingle(OAuthConstants.NONCE, nonceParam);
        redirectMap.putSingle(OAuthConstants.NONCE, nonceParam);
    }
    Map<String, Object> stateMap = CastUtils.cast((Map<?, ?>)requestState);
    String json = jsonp.toJson(stateMap);

    String stateParam = null;
    if (theSigProvider != null) {
        JwsCompactProducer stateProducer = new JwsCompactProducer(json);
        stateParam = stateProducer.signWith(theSigProvider);
    }

    if (theEncryptionProvider != null) {
        stateParam = theEncryptionProvider.encrypt(StringUtils.toBytesUTF8(stateParam), null);
    }
    if (storeInSession) {
        String sessionStateAttribute = OAuthUtils.generateRandomTokenKey();
        OAuthUtils.setSessionToken(mc, stateParam, sessionStateAttribute, 0);
        stateParam = sessionStateAttribute;
    }
    redirectMap.putSingle(OAuthConstants.STATE, stateParam);

    return redirectMap;
}

Example #15

Source File: TestJwts.java From deprecated-security-advanced-modules with Apache License 2.0

5 votes

static String createSigned(JwtToken baseJwt, JsonWebKey jwk, JwsSignatureProvider signatureProvider) {
	JwsHeaders jwsHeaders = new JwsHeaders();
	JwtToken signedToken = new JwtToken(jwsHeaders, baseJwt.getClaims());

	jwsHeaders.setKeyId(jwk.getKeyId());

       return new JoseJwtProducer().processJwt(signedToken, null, signatureProvider);
}

Example #16

Source File: DefaultJoseImpl.java From thorntail with Apache License 2.0

5 votes

private String signCompact(JwsSignatureProvider provider, JwsHeaders headers, String data) {
    try {
        JwsCompactProducer producer = new JwsCompactProducer(headers, data, config.signatureDataDetached());
        return producer.signWith(provider);
    } catch (Exception ex) {
        throw new JoseException("JWS Compact Signature Creation Failure", ex);
    }
}

Example #17

Source File: JAXRSJweJwsTest.java From cxf with Apache License 2.0

5 votes

private BookStore createJweJwsBookStore(String address,
                             JwsSignatureProvider jwsSigProvider,
                             List<?> mbProviders) throws Exception {
    JAXRSClientFactoryBean bean = new JAXRSClientFactoryBean();
    SpringBusFactory bf = new SpringBusFactory();
    URL busFile = JAXRSJweJwsTest.class.getResource("client.xml");
    Bus springBus = bf.createBus(busFile.toString());
    bean.setBus(springBus);
    bean.setServiceClass(BookStore.class);
    bean.setAddress(address);
    List<Object> providers = new LinkedList<>();
    JweWriterInterceptor jweWriter = new JweWriterInterceptor();
    jweWriter.setUseJweOutputStream(true);
    providers.add(jweWriter);
    providers.add(new JweClientResponseFilter());
    JwsWriterInterceptor jwsWriter = new JwsWriterInterceptor();
    if (jwsSigProvider != null) {
        jwsWriter.setSignatureProvider(jwsSigProvider);
    }
    jwsWriter.setUseJwsOutputStream(true);
    providers.add(jwsWriter);
    providers.add(new JwsClientResponseFilter());
    if (mbProviders != null) {
        providers.addAll(mbProviders);
    }
    bean.setProviders(providers);
    bean.getProperties(true).put("rs.security.encryption.out.properties", SERVER_JWEJWS_PROPERTIES);
    bean.getProperties(true).put("rs.security.signature.out.properties", CLIENT_JWEJWS_PROPERTIES);
    bean.getProperties(true).put("rs.security.encryption.in.properties", CLIENT_JWEJWS_PROPERTIES);
    bean.getProperties(true).put("rs.security.signature.in.properties", SERVER_JWEJWS_PROPERTIES);
    PrivateKeyPasswordProvider provider = new PrivateKeyPasswordProviderImpl();
    bean.getProperties(true).put("rs.security.signature.key.password.provider", provider);
    bean.getProperties(true).put("rs.security.decryption.key.password.provider", provider);
    return bean.create(BookStore.class);
}

Example #18

Source File: DefaultJoseImpl.java From thorntail with Apache License 2.0

5 votes

private String signJson(JwsSignatureProvider provider, JwsHeaders headers, String data) {
    try {
        JwsJsonProducer producer = new JwsJsonProducer(data, true, config.signatureDataDetached());
        return producer.signWith(provider, headers);
    } catch (Exception ex) {
        throw new JoseException("JWS JOSE Signature Creation Failure", ex);
    }
}

Example #19

Source File: DefaultJoseImpl.java From thorntail with Apache License 2.0

5 votes

private JwsSignatureProvider getSignatureProvider(Properties props, JwsHeaders headers) {
    if (isInlinedJwkSetAvailable()) {
        return JwsUtils.getSignatureProvider(loadJsonWebKey(signatureKeyAlias()));
    } else {
        return JwsUtils.loadSignatureProvider(props, headers);
    }
}

Example #20