Class JwtIssuerAuthenticationManagerResolver

java.lang.Object

com.codename1.backend.security.oauth2.server.resource.JwtIssuerAuthenticationManagerResolver

All Implemented Interfaces:

AuthenticationManagerResolver

public final class JwtIssuerAuthenticationManagerResolver
extends Object
implements AuthenticationManagerResolver

For a server that takes tokens from several issuers: each token is verified by the issuer it says it is from, and only by that one.

http.oauth2ResourceServer(o -> o.authenticationManagerResolver(
        JwtIssuerAuthenticationManagerResolver.fromTrustedIssuers(
                "https://login.example.com", "https://partners.example.com")));

The iss claim is read out of the token before anything has verified it, and used for one thing: choosing which trusted issuer's keys to verify with. A token that names an issuer not on the list is refused without a request being made anywhere -- the list is what stops a token from pointing the server at keys of its author's choosing. A token that names a trusted issuer it did not come from fails that issuer's signature check.

An issuer's metadata is fetched when its first token arrives, and kept.

Constructor Summary

Constructors

Constructor	Description
JwtIssuerAuthenticationManagerResolver(Map<String, AuthenticationManager> managers)

Method Summary

Modifier and Type	Method	Description
static JwtIssuerAuthenticationManagerResolver	fromDecoders(Map<String, JwtDecoder> decoders)	Trusts these issuers, each verified by the decoder given for it.
static JwtIssuerAuthenticationManagerResolver	fromTrustedIssuers(String... issuers)	Trusts these issuers, each verified with the keys its own metadata names; see JwtDecoders.fromIssuerLocation(String).
AuthenticationManager	resolve(HttpServer.Request request)	One manager for every request: it routes each token by its issuer.

Methods inherited from class Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

JwtIssuerAuthenticationManagerResolver

public JwtIssuerAuthenticationManagerResolver(Map<String, AuthenticationManager> managers)

Parameters:

managers - what authenticates the tokens of each issuer, by the issuer's iss

Method Details

fromTrustedIssuers

public static JwtIssuerAuthenticationManagerResolver fromTrustedIssuers(String... issuers)

Trusts these issuers, each verified with the keys its own metadata names; see JwtDecoders.fromIssuerLocation(String).

fromDecoders

public static JwtIssuerAuthenticationManagerResolver fromDecoders(Map<String, JwtDecoder> decoders)

Trusts these issuers, each verified by the decoder given for it.

resolve

public AuthenticationManager resolve(HttpServer.Request request)

One manager for every request: it routes each token by its issuer.

Specified by:

resolve in interface AuthenticationManagerResolver