keyData : keys.entrySet()) {
- if (!keyData.getKey().equals(kid)) {
+ if (!keyData.getKey().equals(keyId)) {
continue;
}
key = getKey(keyData.getValue());
if (key != null) {
- keyCache.putIfAbsent(kid, key);
+ keyCache.putIfAbsent(keyId, key);
}
}
} catch (IOException e) {
// ignore exception
}
-
return key;
}
-
- @Override
- public ECPrivateKey getPrivateKey() {
- // ignore : only required for signing requests
- return null;
- }
-
- @Override
- public String getPrivateKeyId() {
- // ignore : only required for signing requests
- return null;
- }
};
private static String getBaseUrl(URL url) throws Exception {
@@ -108,7 +107,7 @@ private static String getBaseUrl(URL url) throws Exception {
return (url.getProtocol() + "://" + url.getHost() + path).trim();
}
- DecodedJWT verifyJWTToken(HttpRequest request) throws Exception {
+ Jwt verifyJWTToken(HttpRequest request) throws Exception {
// Check for iap jwt header in incoming request
String jwtToken =
request.getHeaders().getFirstHeaderStringValue("x-goog-authenticated-user-jwt");
@@ -119,24 +118,25 @@ DecodedJWT verifyJWTToken(HttpRequest request) throws Exception {
return verifyJWTToken(jwtToken, baseUrl);
}
- DecodedJWT verifyJWTToken(String jwtToken, String baseUrl) throws Exception {
- Algorithm algorithm = Algorithm.ECDSA256(keyProvider);
-
- // Time constraints are automatically checked, use acceptLeeway to specify a leeway window
+ Jwt verifyJWTToken(String jwtToken, String baseUrl) throws Exception {
+ // Time constraints are automatically checked, use setAllowedClockSkewSeconds
+ // to specify a leeway window
// The token was issued in a past date "iat" < TODAY
// The token hasn't expired yet "exp" > TODAY
- JWTVerifier verifier =
- JWT.require(algorithm).withAudience(baseUrl).withIssuer(IAP_ISSUER_URL).build();
-
- DecodedJWT decodedJWT = verifier.verify(jwtToken);
-
- if (decodedJWT.getSubject() == null) {
- throw new JWTVerificationException("Subject expected, not found");
+ Jwt jwt =
+ Jwts.parser()
+ .setSigningKeyResolver(resolver)
+ .requireAudience(baseUrl)
+ .requireIssuer(IAP_ISSUER_URL)
+ .parse(jwtToken);
+ DefaultClaims claims = (DefaultClaims) jwt.getBody();
+ if (claims.getSubject() == null) {
+ throw new Exception("Subject expected, not found.");
}
- if (decodedJWT.getClaim("email") == null) {
- throw new JWTVerificationException("Email expected, not found");
+ if (claims.get("email") == null) {
+ throw new Exception("Email expected, not found.");
}
- return decodedJWT;
+ return jwt;
}
private ECPublicKey getKey(String keyText) throws IOException {
diff --git a/iap/src/test/java/com/example/iap/BuildAndVerifyIapRequestIT.java b/iap/src/test/java/com/example/iap/BuildAndVerifyIapRequestIT.java
index 3638599a5dc..89bce31fa1f 100644
--- a/iap/src/test/java/com/example/iap/BuildAndVerifyIapRequestIT.java
+++ b/iap/src/test/java/com/example/iap/BuildAndVerifyIapRequestIT.java
@@ -1,32 +1,29 @@
/**
* Copyright 2017 Google Inc.
*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of the License at
*
- * http://www.apache.org/licenses/LICENSE-2.0
+ *
http://www.apache.org/licenses/LICENSE-2.0
*
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
+ *
Unless required by applicable law or agreed to in writing, software distributed under the
+ * License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing permissions and
* limitations under the License.
*/
-
package com.example.iap;
import static com.example.iap.BuildIapRequest.buildIAPRequest;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
-import com.auth0.jwt.interfaces.DecodedJWT;
import com.google.api.client.http.GenericUrl;
import com.google.api.client.http.HttpRequest;
import com.google.api.client.http.HttpResponse;
import com.google.api.client.http.HttpResponseException;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.http.javanet.NetHttpTransport;
+import io.jsonwebtoken.Jwt;
import org.apache.http.HttpStatus;
import org.junit.Before;
import org.junit.Test;
@@ -70,7 +67,7 @@ public void testGenerateAndVerifyIapRequestIsSuccessful() throws Exception {
assertNotNull(split);
assertEquals(split.length, 2);
assertEquals(split[0].trim(), "x-goog-authenticated-user-jwt");
- DecodedJWT decodedJWT = verifyIapRequestHeader.verifyJWTToken(split[1].trim(), iapProtectedUrl);
+ Jwt decodedJWT = verifyIapRequestHeader.verifyJWTToken(split[1].trim(), iapProtectedUrl);
assertNotNull(decodedJWT);
}
}