You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2015/10/13 12:42:10 UTC
[10/20] cxf git commit: Splitting current jose module into jose-core
+ jose-jaxrs
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/pom.xml
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/pom.xml b/rt/rs/security/jose/jose-jaxrs/pom.xml
new file mode 100644
index 0000000..b935370
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/pom.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+ <artifactId>cxf-rt-rs-security-jose-jaxrs</artifactId>
+ <packaging>bundle</packaging>
+ <name>Apache CXF Runtime JOSE JAX-RS</name>
+ <description>Apache CXF Runtime JOSE JAX-RS</description>
+ <url>http://cxf.apache.org</url>
+ <parent>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-parent</artifactId>
+ <version>3.1.4-SNAPSHOT</version>
+ <relativePath>../../../../../parent/pom.xml</relativePath>
+ </parent>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-core</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-rt-security</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-rt-rs-security-jose-core</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <!--test dependencies-->
+ <dependency>
+ <groupId>junit</groupId>
+ <artifactId>junit</artifactId>
+ <scope>test</scope>
+ </dependency>
+ </dependencies>
+</project>
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJweDecryptingFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJweDecryptingFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJweDecryptingFilter.java
new file mode 100644
index 0000000..0d7d915
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJweDecryptingFilter.java
@@ -0,0 +1,62 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.rs.security.jose.jwe.JweCompactConsumer;
+import org.apache.cxf.rs.security.jose.jwe.JweDecryptionOutput;
+import org.apache.cxf.rs.security.jose.jwe.JweDecryptionProvider;
+import org.apache.cxf.rs.security.jose.jwe.JweHeaders;
+import org.apache.cxf.rs.security.jose.jwe.JweUtils;
+
+public class AbstractJweDecryptingFilter {
+ private JweDecryptionProvider decryption;
+ private String defaultMediaType;
+ protected JweDecryptionOutput decrypt(InputStream is) throws IOException {
+ JweCompactConsumer jwe = new JweCompactConsumer(new String(IOUtils.readBytesFromStream(is), "UTF-8"));
+ JweDecryptionProvider theDecryptor = getInitializedDecryptionProvider(jwe.getJweHeaders());
+ JweDecryptionOutput out = new JweDecryptionOutput(jwe.getJweHeaders(), jwe.getDecryptedContent(theDecryptor));
+ validateHeaders(out.getHeaders());
+ return out;
+ }
+
+ protected void validateHeaders(JweHeaders headers) {
+ // complete
+ }
+ public void setDecryptionProvider(JweDecryptionProvider decryptor) {
+ this.decryption = decryptor;
+ }
+ protected JweDecryptionProvider getInitializedDecryptionProvider(JweHeaders headers) {
+ if (decryption != null) {
+ return decryption;
+ }
+ return JweUtils.loadDecryptionProvider(headers, true);
+ }
+ public String getDefaultMediaType() {
+ return defaultMediaType;
+ }
+
+ public void setDefaultMediaType(String defaultMediaType) {
+ this.defaultMediaType = defaultMediaType;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonReaderProvider.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonReaderProvider.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonReaderProvider.java
new file mode 100644
index 0000000..094991e
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonReaderProvider.java
@@ -0,0 +1,91 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.logging.Logger;
+
+import org.apache.cxf.common.logging.LogUtils;
+import org.apache.cxf.helpers.CastUtils;
+import org.apache.cxf.jaxrs.utils.JAXRSUtils;
+import org.apache.cxf.message.Message;
+import org.apache.cxf.message.MessageUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsException;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
+import org.apache.cxf.rs.security.jose.jws.JwsUtils;
+
+public class AbstractJwsJsonReaderProvider {
+ protected static final Logger LOG = LogUtils.getL7dLogger(AbstractJwsJsonReaderProvider.class);
+ private static final String RSSEC_SIGNATURE_IN_LIST_PROPS = "rs.security.signature.in.list.properties";
+ private static final String RSSEC_SIGNATURE_LIST_PROPS = "rs.security.signature.list.properties";
+
+ private List<JwsSignatureVerifier> sigVerifiers;
+ private String defaultMediaType;
+ private boolean strictVerification;
+
+ public void setSignatureVerifier(JwsSignatureVerifier signatureVerifier) {
+ setSignatureVerifiers(Collections.singletonList(signatureVerifier));
+ }
+ public void setSignatureVerifiers(List<JwsSignatureVerifier> signatureVerifiers) {
+ this.sigVerifiers = signatureVerifiers;
+ }
+
+ protected List<JwsSignatureVerifier> getInitializedSigVerifiers() {
+ if (sigVerifiers != null) {
+ return sigVerifiers;
+ }
+ Message m = JAXRSUtils.getCurrentMessage();
+ Object propLocsProp =
+ MessageUtils.getContextualProperty(m, RSSEC_SIGNATURE_IN_LIST_PROPS, RSSEC_SIGNATURE_LIST_PROPS);
+ if (propLocsProp == null) {
+ LOG.warning("JWS JSON init properties resource is not identified");
+ throw new JwsException(JwsException.Error.NO_INIT_PROPERTIES);
+ }
+ List<String> propLocs = null;
+ if (propLocsProp instanceof String) {
+ String[] props = ((String)propLocsProp).split(",");
+ propLocs = Arrays.asList(props);
+ } else {
+ propLocs = CastUtils.cast((List<?>)propLocsProp);
+ }
+ List<JwsSignatureVerifier> theSigVerifiers = new LinkedList<JwsSignatureVerifier>();
+ for (String propLoc : propLocs) {
+ theSigVerifiers.addAll(JwsUtils.loadSignatureVerifiers(propLoc, m));
+ }
+ return theSigVerifiers;
+ }
+
+ public String getDefaultMediaType() {
+ return defaultMediaType;
+ }
+
+ public void setDefaultMediaType(String defaultMediaType) {
+ this.defaultMediaType = defaultMediaType;
+ }
+ public boolean isStrictVerification() {
+ return strictVerification;
+ }
+ public void setStrictVerification(boolean strictVerification) {
+ this.strictVerification = strictVerification;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonWriterProvider.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonWriterProvider.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonWriterProvider.java
new file mode 100644
index 0000000..d5068e2
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonWriterProvider.java
@@ -0,0 +1,86 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.logging.Logger;
+
+import org.apache.cxf.common.logging.LogUtils;
+import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.helpers.CastUtils;
+import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.jaxrs.utils.JAXRSUtils;
+import org.apache.cxf.message.Message;
+import org.apache.cxf.message.MessageUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsException;
+import org.apache.cxf.rs.security.jose.jws.JwsJsonProducer;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider;
+import org.apache.cxf.rs.security.jose.jws.JwsUtils;
+
+public class AbstractJwsJsonWriterProvider {
+ protected static final Logger LOG = LogUtils.getL7dLogger(AbstractJwsJsonWriterProvider.class);
+ private static final String RSSEC_SIGNATURE_OUT_LIST_PROPS = "rs.security.signature.out.list.properties";
+ private static final String RSSEC_SIGNATURE_LIST_PROPS = "rs.security.signature.list.properties";
+
+ private List<JwsSignatureProvider> sigProviders;
+
+ public void setSignatureProvider(JwsSignatureProvider signatureProvider) {
+ setSignatureProviders(Collections.singletonList(signatureProvider));
+ }
+ public void setSignatureProviders(List<JwsSignatureProvider> signatureProviders) {
+ this.sigProviders = signatureProviders;
+ }
+
+ protected List<JwsSignatureProvider> getInitializedSigProviders() {
+ if (sigProviders != null) {
+ return sigProviders;
+ }
+ Message m = JAXRSUtils.getCurrentMessage();
+ Object propLocsProp =
+ MessageUtils.getContextualProperty(m, RSSEC_SIGNATURE_OUT_LIST_PROPS, RSSEC_SIGNATURE_LIST_PROPS);
+ if (propLocsProp == null) {
+ LOG.warning("JWS JSON init properties resource is not identified");
+ throw new JwsException(JwsException.Error.NO_INIT_PROPERTIES);
+ }
+ List<String> propLocs = null;
+ if (propLocsProp instanceof String) {
+ String[] props = ((String)propLocsProp).split(",");
+ propLocs = Arrays.asList(props);
+ } else {
+ propLocs = CastUtils.cast((List<?>)propLocsProp);
+ }
+ List<JwsSignatureProvider> theSigProviders = new LinkedList<JwsSignatureProvider>();
+ for (String propLoc : propLocs) {
+ theSigProviders.addAll(JwsUtils.loadSignatureProviders(propLoc, m));
+ }
+ return theSigProviders;
+ }
+ protected void writeJws(JwsJsonProducer p, OutputStream os)
+ throws IOException {
+ byte[] bytes = StringUtils.toBytesUTF8(p.getJwsJsonSignedDocument());
+ IOUtils.copy(new ByteArrayInputStream(bytes), os);
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsReaderProvider.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsReaderProvider.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsReaderProvider.java
new file mode 100644
index 0000000..0e8b0d0
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsReaderProvider.java
@@ -0,0 +1,48 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import org.apache.cxf.rs.security.jose.jws.JwsHeaders;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
+import org.apache.cxf.rs.security.jose.jws.JwsUtils;
+
+public class AbstractJwsReaderProvider {
+ private JwsSignatureVerifier sigVerifier;
+ private String defaultMediaType;
+
+ public void setSignatureVerifier(JwsSignatureVerifier signatureVerifier) {
+ this.sigVerifier = signatureVerifier;
+ }
+
+ protected JwsSignatureVerifier getInitializedSigVerifier(JwsHeaders headers) {
+ if (sigVerifier != null) {
+ return sigVerifier;
+ }
+ return JwsUtils.loadSignatureVerifier(headers, true);
+ }
+
+ public String getDefaultMediaType() {
+ return defaultMediaType;
+ }
+
+ public void setDefaultMediaType(String defaultMediaType) {
+ this.defaultMediaType = defaultMediaType;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsWriterProvider.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsWriterProvider.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsWriterProvider.java
new file mode 100644
index 0000000..33ec0b0
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsWriterProvider.java
@@ -0,0 +1,58 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+
+import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.rs.security.jose.JoseHeaders;
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsCompactProducer;
+import org.apache.cxf.rs.security.jose.jws.JwsHeaders;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider;
+import org.apache.cxf.rs.security.jose.jws.JwsUtils;
+
+public class AbstractJwsWriterProvider {
+ private JwsSignatureProvider sigProvider;
+
+ public void setSignatureProvider(JwsSignatureProvider signatureProvider) {
+ this.sigProvider = signatureProvider;
+ }
+
+ protected JwsSignatureProvider getInitializedSigProvider(JwsHeaders headers) {
+ setRequestContextProperty(headers);
+ if (sigProvider != null) {
+ return sigProvider;
+ }
+ return JwsUtils.loadSignatureProvider(headers, true);
+ }
+ protected void setRequestContextProperty(JoseHeaders headers) {
+ JoseUtils.setJoseContextProperty(headers);
+ }
+ protected void writeJws(JwsCompactProducer p, JwsSignatureProvider theSigProvider, OutputStream os)
+ throws IOException {
+ p.signWith(theSigProvider);
+ byte[] bytes = StringUtils.toBytesUTF8(p.getSignedEncodedJws());
+ IOUtils.copy(new ByteArrayInputStream(bytes), os);
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JsonWebKeysProvider.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JsonWebKeysProvider.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JsonWebKeysProvider.java
new file mode 100644
index 0000000..a877925
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JsonWebKeysProvider.java
@@ -0,0 +1,48 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Type;
+
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.MultivaluedMap;
+import javax.ws.rs.ext.MessageBodyReader;
+
+import org.apache.cxf.rs.security.jose.jwk.JsonWebKeys;
+import org.apache.cxf.rs.security.jose.jwk.JwkUtils;
+
+public class JsonWebKeysProvider implements MessageBodyReader<JsonWebKeys> {
+
+ @Override
+ public boolean isReadable(Class<?> cls, Type type, Annotation[] anns, MediaType mt) {
+ return cls == JsonWebKeys.class;
+ }
+
+ @Override
+ public JsonWebKeys readFrom(Class<JsonWebKeys> cls, Type t, Annotation[] anns, MediaType mt,
+ MultivaluedMap<String, String> headers, InputStream is) throws IOException,
+ WebApplicationException {
+ return JwkUtils.readJwkSet(is);
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweClientResponseFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweClientResponseFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweClientResponseFilter.java
new file mode 100644
index 0000000..d04d4c2
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweClientResponseFilter.java
@@ -0,0 +1,46 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import javax.annotation.Priority;
+import javax.ws.rs.client.ClientRequestContext;
+import javax.ws.rs.client.ClientResponseContext;
+import javax.ws.rs.client.ClientResponseFilter;
+
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jwe.JweDecryptionOutput;
+
+@Priority(Priorities.JWE_CLIENT_READ_PRIORITY)
+public class JweClientResponseFilter extends AbstractJweDecryptingFilter implements ClientResponseFilter {
+ @Override
+ public void filter(ClientRequestContext req, ClientResponseContext res) throws IOException {
+ JweDecryptionOutput out = decrypt(res.getEntityStream());
+ byte[] bytes = out.getContent();
+ res.setEntityStream(new ByteArrayInputStream(bytes));
+ res.getHeaders().putSingle("Content-Length", Integer.toString(bytes.length));
+ String ct = JoseUtils.checkContentType(out.getHeaders().getContentType(), getDefaultMediaType());
+ if (ct != null) {
+ res.getHeaders().putSingle("Content-Type", ct);
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweContainerRequestFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweContainerRequestFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweContainerRequestFilter.java
new file mode 100644
index 0000000..a362f76
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweContainerRequestFilter.java
@@ -0,0 +1,50 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import javax.annotation.Priority;
+import javax.ws.rs.HttpMethod;
+import javax.ws.rs.container.ContainerRequestContext;
+import javax.ws.rs.container.ContainerRequestFilter;
+import javax.ws.rs.container.PreMatching;
+
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jwe.JweDecryptionOutput;
+
+@PreMatching
+@Priority(Priorities.JWE_SERVER_READ_PRIORITY)
+public class JweContainerRequestFilter extends AbstractJweDecryptingFilter implements ContainerRequestFilter {
+ @Override
+ public void filter(ContainerRequestContext context) throws IOException {
+ if (HttpMethod.GET.equals(context.getMethod())) {
+ return;
+ }
+ JweDecryptionOutput out = decrypt(context.getEntityStream());
+ byte[] bytes = out.getContent();
+ context.setEntityStream(new ByteArrayInputStream(bytes));
+ context.getHeaders().putSingle("Content-Length", Integer.toString(bytes.length));
+ String ct = JoseUtils.checkContentType(out.getHeaders().getContentType(), getDefaultMediaType());
+ if (ct != null) {
+ context.getHeaders().putSingle("Content-Type", ct);
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweWriterInterceptor.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweWriterInterceptor.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweWriterInterceptor.java
new file mode 100644
index 0000000..108a15f
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JweWriterInterceptor.java
@@ -0,0 +1,133 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.util.logging.Logger;
+import java.util.zip.DeflaterOutputStream;
+
+import javax.annotation.Priority;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.ext.WriterInterceptor;
+import javax.ws.rs.ext.WriterInterceptorContext;
+
+import org.apache.cxf.common.logging.LogUtils;
+import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.io.CachedOutputStream;
+import org.apache.cxf.jaxrs.utils.JAXRSUtils;
+import org.apache.cxf.rs.security.jose.JoseConstants;
+import org.apache.cxf.rs.security.jose.jwe.JweCompactProducer;
+import org.apache.cxf.rs.security.jose.jwe.JweEncryptionInput;
+import org.apache.cxf.rs.security.jose.jwe.JweEncryptionOutput;
+import org.apache.cxf.rs.security.jose.jwe.JweEncryptionProvider;
+import org.apache.cxf.rs.security.jose.jwe.JweException;
+import org.apache.cxf.rs.security.jose.jwe.JweHeaders;
+import org.apache.cxf.rs.security.jose.jwe.JweOutputStream;
+import org.apache.cxf.rs.security.jose.jwe.JweUtils;
+
+@Priority(Priorities.JWE_WRITE_PRIORITY)
+public class JweWriterInterceptor implements WriterInterceptor {
+ protected static final Logger LOG = LogUtils.getL7dLogger(JweWriterInterceptor.class);
+ private JweEncryptionProvider encryptionProvider;
+ private boolean contentTypeRequired = true;
+ private boolean useJweOutputStream;
+ @Override
+ public void aroundWriteTo(WriterInterceptorContext ctx) throws IOException, WebApplicationException {
+ if (ctx.getEntity() == null) {
+ ctx.proceed();
+ return;
+ }
+ OutputStream actualOs = ctx.getOutputStream();
+ JweHeaders jweHeaders = new JweHeaders();
+ JweEncryptionProvider theEncryptionProvider = getInitializedEncryptionProvider(jweHeaders);
+
+ String ctString = null;
+ MediaType contentMediaType = ctx.getMediaType();
+ if (contentTypeRequired && contentMediaType != null) {
+ if ("application".equals(contentMediaType.getType())) {
+ ctString = contentMediaType.getSubtype();
+ } else {
+ ctString = JAXRSUtils.mediaTypeToString(contentMediaType);
+ }
+ }
+ if (ctString != null) {
+ jweHeaders.setContentType(ctString);
+ }
+
+ if (useJweOutputStream) {
+ JweEncryptionOutput encryption =
+ theEncryptionProvider.getEncryptionOutput(new JweEncryptionInput(jweHeaders));
+ try {
+ JweCompactProducer.startJweContent(actualOs,
+ encryption.getHeaders(),
+ encryption.getContentEncryptionKey(),
+ encryption.getIv());
+ } catch (IOException ex) {
+ LOG.warning("JWE encryption error");
+ throw new JweException(JweException.Error.CONTENT_ENCRYPTION_FAILURE, ex);
+ }
+ OutputStream wrappedStream = null;
+ JweOutputStream jweOutputStream = new JweOutputStream(actualOs, encryption.getCipher(),
+ encryption.getAuthTagProducer());
+ wrappedStream = jweOutputStream;
+ if (encryption.isCompressionSupported()) {
+ wrappedStream = new DeflaterOutputStream(jweOutputStream);
+ }
+
+ ctx.setOutputStream(wrappedStream);
+ ctx.proceed();
+ setJoseMediaType(ctx);
+ jweOutputStream.finalFlush();
+ } else {
+ CachedOutputStream cos = new CachedOutputStream();
+ ctx.setOutputStream(cos);
+ ctx.proceed();
+ String jweContent = theEncryptionProvider.encrypt(cos.getBytes(), jweHeaders);
+ setJoseMediaType(ctx);
+ IOUtils.copy(new ByteArrayInputStream(StringUtils.toBytesUTF8(jweContent)),
+ actualOs);
+ actualOs.flush();
+ }
+ }
+
+ private void setJoseMediaType(WriterInterceptorContext ctx) {
+ MediaType joseMediaType = JAXRSUtils.toMediaType(JoseConstants.MEDIA_TYPE_JOSE);
+ ctx.setMediaType(joseMediaType);
+ }
+
+ protected JweEncryptionProvider getInitializedEncryptionProvider(JweHeaders headers) {
+ if (encryptionProvider != null) {
+ return encryptionProvider;
+ }
+ return JweUtils.loadEncryptionProvider(headers, true);
+ }
+
+ public void setUseJweOutputStream(boolean useJweOutputStream) {
+ this.useJweOutputStream = useJweOutputStream;
+ }
+
+ public void setEncryptionProvider(JweEncryptionProvider encryptionProvider) {
+ this.encryptionProvider = encryptionProvider;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsClientResponseFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsClientResponseFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsClientResponseFilter.java
new file mode 100644
index 0000000..8b811ec
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsClientResponseFilter.java
@@ -0,0 +1,53 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import javax.annotation.Priority;
+import javax.ws.rs.client.ClientRequestContext;
+import javax.ws.rs.client.ClientResponseContext;
+import javax.ws.rs.client.ClientResponseFilter;
+
+import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsCompactConsumer;
+import org.apache.cxf.rs.security.jose.jws.JwsException;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
+
+@Priority(Priorities.JWS_CLIENT_READ_PRIORITY)
+public class JwsClientResponseFilter extends AbstractJwsReaderProvider implements ClientResponseFilter {
+ @Override
+ public void filter(ClientRequestContext req, ClientResponseContext res) throws IOException {
+ JwsCompactConsumer p = new JwsCompactConsumer(IOUtils.readStringFromStream(res.getEntityStream()));
+ JwsSignatureVerifier theSigVerifier = getInitializedSigVerifier(p.getJwsHeaders());
+ if (!p.verifySignatureWith(theSigVerifier)) {
+ throw new JwsException(JwsException.Error.INVALID_SIGNATURE);
+ }
+ byte[] bytes = p.getDecodedJwsPayloadBytes();
+ res.setEntityStream(new ByteArrayInputStream(bytes));
+ res.getHeaders().putSingle("Content-Length", Integer.toString(bytes.length));
+ String ct = JoseUtils.checkContentType(p.getJwsHeaders().getContentType(), getDefaultMediaType());
+ if (ct != null) {
+ res.getHeaders().putSingle("Content-Type", ct);
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsContainerRequestFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsContainerRequestFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsContainerRequestFilter.java
new file mode 100644
index 0000000..8a3a069
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsContainerRequestFilter.java
@@ -0,0 +1,61 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import javax.annotation.Priority;
+import javax.ws.rs.HttpMethod;
+import javax.ws.rs.container.ContainerRequestContext;
+import javax.ws.rs.container.ContainerRequestFilter;
+import javax.ws.rs.container.PreMatching;
+
+import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.jaxrs.utils.JAXRSUtils;
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsCompactConsumer;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
+
+@PreMatching
+@Priority(Priorities.JWS_SERVER_READ_PRIORITY)
+public class JwsContainerRequestFilter extends AbstractJwsReaderProvider implements ContainerRequestFilter {
+ @Override
+ public void filter(ContainerRequestContext context) throws IOException {
+ if (HttpMethod.GET.equals(context.getMethod())) {
+ return;
+ }
+ JwsCompactConsumer p = new JwsCompactConsumer(IOUtils.readStringFromStream(context.getEntityStream()));
+ JwsSignatureVerifier theSigVerifier = getInitializedSigVerifier(p.getJwsHeaders());
+ if (!p.verifySignatureWith(theSigVerifier)) {
+ context.abortWith(JAXRSUtils.toResponse(400));
+ return;
+ }
+ JoseUtils.validateRequestContextProperty(p.getJwsHeaders());
+ byte[] bytes = p.getDecodedJwsPayloadBytes();
+ context.setEntityStream(new ByteArrayInputStream(bytes));
+ context.getHeaders().putSingle("Content-Length", Integer.toString(bytes.length));
+
+ String ct = JoseUtils.checkContentType(p.getJwsHeaders().getContentType(), getDefaultMediaType());
+ if (ct != null) {
+ context.getHeaders().putSingle("Content-Type", ct);
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonClientResponseFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonClientResponseFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonClientResponseFilter.java
new file mode 100644
index 0000000..728c19d
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonClientResponseFilter.java
@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.util.List;
+
+import javax.annotation.Priority;
+import javax.ws.rs.client.ClientRequestContext;
+import javax.ws.rs.client.ClientResponseContext;
+import javax.ws.rs.client.ClientResponseFilter;
+
+import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsException;
+import org.apache.cxf.rs.security.jose.jws.JwsJsonConsumer;
+import org.apache.cxf.rs.security.jose.jws.JwsJsonSignatureEntry;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
+
+@Priority(Priorities.JWS_CLIENT_READ_PRIORITY)
+public class JwsJsonClientResponseFilter extends AbstractJwsJsonReaderProvider implements ClientResponseFilter {
+ @Override
+ public void filter(ClientRequestContext req, ClientResponseContext res) throws IOException {
+ List<JwsSignatureVerifier> theSigVerifiers = getInitializedSigVerifiers();
+ JwsJsonConsumer p = new JwsJsonConsumer(IOUtils.readStringFromStream(res.getEntityStream()));
+ if (isStrictVerification() && p.getSignatureEntries().size() != theSigVerifiers.size()
+ || !p.verifySignatureWith(theSigVerifiers)) {
+ throw new JwsException(JwsException.Error.INVALID_SIGNATURE);
+ }
+ byte[] bytes = p.getDecodedJwsPayloadBytes();
+ res.setEntityStream(new ByteArrayInputStream(bytes));
+ res.getHeaders().putSingle("Content-Length", Integer.toString(bytes.length));
+
+ // the list is guaranteed to be non-empty
+ JwsJsonSignatureEntry sigEntry = p.getSignatureEntries().get(0);
+ String ct = JoseUtils.checkContentType(sigEntry.getUnionHeader().getContentType(), getDefaultMediaType());
+ if (ct != null) {
+ res.getHeaders().putSingle("Content-Type", ct);
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonContainerRequestFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonContainerRequestFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonContainerRequestFilter.java
new file mode 100644
index 0000000..7512536
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonContainerRequestFilter.java
@@ -0,0 +1,65 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.util.List;
+
+import javax.annotation.Priority;
+import javax.ws.rs.HttpMethod;
+import javax.ws.rs.container.ContainerRequestContext;
+import javax.ws.rs.container.ContainerRequestFilter;
+import javax.ws.rs.container.PreMatching;
+
+import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.jaxrs.utils.JAXRSUtils;
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsJsonConsumer;
+import org.apache.cxf.rs.security.jose.jws.JwsJsonSignatureEntry;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
+
+@PreMatching
+@Priority(Priorities.JWS_SERVER_READ_PRIORITY)
+public class JwsJsonContainerRequestFilter extends AbstractJwsJsonReaderProvider implements ContainerRequestFilter {
+ @Override
+ public void filter(ContainerRequestContext context) throws IOException {
+ if (HttpMethod.GET.equals(context.getMethod())) {
+ return;
+ }
+ List<JwsSignatureVerifier> theSigVerifiers = getInitializedSigVerifiers();
+ JwsJsonConsumer p = new JwsJsonConsumer(IOUtils.readStringFromStream(context.getEntityStream()));
+
+ if (isStrictVerification() && p.getSignatureEntries().size() != theSigVerifiers.size()
+ || !p.verifySignatureWith(theSigVerifiers)) {
+ context.abortWith(JAXRSUtils.toResponse(400));
+ return;
+ }
+ byte[] bytes = p.getDecodedJwsPayloadBytes();
+ context.setEntityStream(new ByteArrayInputStream(bytes));
+ context.getHeaders().putSingle("Content-Length", Integer.toString(bytes.length));
+
+ // the list is guaranteed to be non-empty
+ JwsJsonSignatureEntry sigEntry = p.getSignatureEntries().get(0);
+ String ct = JoseUtils.checkContentType(sigEntry.getUnionHeader().getContentType(), getDefaultMediaType());
+ if (ct != null) {
+ context.getHeaders().putSingle("Content-Type", ct);
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonWriterInterceptor.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonWriterInterceptor.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonWriterInterceptor.java
new file mode 100644
index 0000000..89b611d
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonWriterInterceptor.java
@@ -0,0 +1,138 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Priority;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.ext.WriterInterceptor;
+import javax.ws.rs.ext.WriterInterceptorContext;
+
+import org.apache.cxf.common.util.Base64UrlOutputStream;
+import org.apache.cxf.common.util.Base64UrlUtility;
+import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.io.CachedOutputStream;
+import org.apache.cxf.jaxrs.provider.json.JsonMapObjectReaderWriter;
+import org.apache.cxf.jaxrs.utils.JAXRSUtils;
+import org.apache.cxf.rs.security.jose.JoseConstants;
+import org.apache.cxf.rs.security.jose.JoseHeaders;
+import org.apache.cxf.rs.security.jose.jws.JwsHeaders;
+import org.apache.cxf.rs.security.jose.jws.JwsJsonOutputStream;
+import org.apache.cxf.rs.security.jose.jws.JwsJsonProducer;
+import org.apache.cxf.rs.security.jose.jws.JwsSignature;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider;
+
+@Priority(Priorities.JWS_WRITE_PRIORITY)
+public class JwsJsonWriterInterceptor extends AbstractJwsJsonWriterProvider implements WriterInterceptor {
+ private JsonMapObjectReaderWriter writer = new JsonMapObjectReaderWriter();
+ private boolean contentTypeRequired = true;
+ private boolean useJwsOutputStream;
+ private boolean encodePayload = true;
+ @Override
+ public void aroundWriteTo(WriterInterceptorContext ctx) throws IOException, WebApplicationException {
+ if (ctx.getEntity() == null) {
+ ctx.proceed();
+ return;
+ }
+ List<JwsSignatureProvider> sigProviders = getInitializedSigProviders();
+ OutputStream actualOs = ctx.getOutputStream();
+ if (useJwsOutputStream) {
+ List<String> protectedHeaders = new ArrayList<String>(sigProviders.size());
+ List<JwsSignature> signatures = new ArrayList<JwsSignature>(sigProviders.size());
+ for (JwsSignatureProvider signer : sigProviders) {
+ JwsHeaders protectedHeader = prepareProtectedHeader(ctx, signer);
+ String encoded = Base64UrlUtility.encode(writer.toJson(protectedHeader));
+ protectedHeaders.add(encoded);
+ JwsSignature signature = signer.createJwsSignature(protectedHeader);
+ byte[] start = StringUtils.toBytesUTF8(encoded + ".");
+ signature.update(start, 0, start.length);
+ signatures.add(signature);
+ }
+ ctx.setMediaType(JAXRSUtils.toMediaType(JoseConstants.MEDIA_TYPE_JOSE_JSON));
+ actualOs.write(StringUtils.toBytesUTF8("{\"payload\":\""));
+ JwsJsonOutputStream jwsStream = new JwsJsonOutputStream(actualOs, protectedHeaders, signatures);
+
+ Base64UrlOutputStream base64Stream = null;
+ if (encodePayload) {
+ base64Stream = new Base64UrlOutputStream(jwsStream);
+ ctx.setOutputStream(base64Stream);
+ } else {
+ ctx.setOutputStream(jwsStream);
+ }
+ ctx.proceed();
+ if (encodePayload) {
+ base64Stream.flush();
+ }
+ jwsStream.flush();
+ } else {
+ CachedOutputStream cos = new CachedOutputStream();
+ ctx.setOutputStream(cos);
+ ctx.proceed();
+ JwsJsonProducer p = new JwsJsonProducer(new String(cos.getBytes(), "UTF-8"));
+ for (JwsSignatureProvider signer : sigProviders) {
+ JwsHeaders protectedHeader = prepareProtectedHeader(ctx, signer);
+ p.signWith(signer, protectedHeader, null);
+ }
+ ctx.setMediaType(JAXRSUtils.toMediaType(JoseConstants.MEDIA_TYPE_JOSE_JSON));
+ writeJws(p, actualOs);
+ }
+
+ }
+
+ private JwsHeaders prepareProtectedHeader(WriterInterceptorContext ctx,
+ JwsSignatureProvider signer) {
+ JwsHeaders headers = new JwsHeaders();
+ headers.setSignatureAlgorithm(signer.getAlgorithm());
+ setContentTypeIfNeeded(headers, ctx);
+ if (!encodePayload) {
+ headers.setPayloadEncodingStatus(false);
+ }
+ return headers;
+ }
+
+ public void setContentTypeRequired(boolean contentTypeRequired) {
+ this.contentTypeRequired = contentTypeRequired;
+ }
+ public void setUseJwsJsonOutputStream(boolean useJwsJsonOutputStream) {
+ this.useJwsOutputStream = useJwsJsonOutputStream;
+ }
+ private void setContentTypeIfNeeded(JoseHeaders headers, WriterInterceptorContext ctx) {
+ if (contentTypeRequired) {
+ MediaType mt = ctx.getMediaType();
+ if (mt != null
+ && !JAXRSUtils.mediaTypeToString(mt).equals(JoseConstants.MEDIA_TYPE_JOSE_JSON)) {
+ if ("application".equals(mt.getType())) {
+ headers.setContentType(mt.getSubtype());
+ } else {
+ headers.setContentType(JAXRSUtils.mediaTypeToString(mt));
+ }
+ }
+ }
+ }
+
+ public void setEncodePayload(boolean encodePayload) {
+ this.encodePayload = encodePayload;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsWriterInterceptor.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsWriterInterceptor.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsWriterInterceptor.java
new file mode 100644
index 0000000..5deaceb
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsWriterInterceptor.java
@@ -0,0 +1,107 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.IOException;
+import java.io.OutputStream;
+
+import javax.annotation.Priority;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.ext.WriterInterceptor;
+import javax.ws.rs.ext.WriterInterceptorContext;
+
+import org.apache.cxf.common.util.Base64UrlOutputStream;
+import org.apache.cxf.common.util.Base64UrlUtility;
+import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.io.CachedOutputStream;
+import org.apache.cxf.jaxrs.provider.json.JsonMapObjectReaderWriter;
+import org.apache.cxf.jaxrs.utils.JAXRSUtils;
+import org.apache.cxf.rs.security.jose.JoseConstants;
+import org.apache.cxf.rs.security.jose.JoseHeaders;
+import org.apache.cxf.rs.security.jose.jws.JwsCompactProducer;
+import org.apache.cxf.rs.security.jose.jws.JwsHeaders;
+import org.apache.cxf.rs.security.jose.jws.JwsOutputStream;
+import org.apache.cxf.rs.security.jose.jws.JwsSignature;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider;
+
+@Priority(Priorities.JWS_WRITE_PRIORITY)
+public class JwsWriterInterceptor extends AbstractJwsWriterProvider implements WriterInterceptor {
+ private boolean contentTypeRequired = true;
+ private boolean useJwsOutputStream;
+ private JsonMapObjectReaderWriter writer = new JsonMapObjectReaderWriter();
+ @Override
+ public void aroundWriteTo(WriterInterceptorContext ctx) throws IOException, WebApplicationException {
+ if (ctx.getEntity() == null) {
+ ctx.proceed();
+ return;
+ }
+ JwsHeaders headers = new JwsHeaders();
+ JwsSignatureProvider sigProvider = getInitializedSigProvider(headers);
+ setContentTypeIfNeeded(headers, ctx);
+ OutputStream actualOs = ctx.getOutputStream();
+ if (useJwsOutputStream) {
+ JwsSignature jwsSignature = sigProvider.createJwsSignature(headers);
+ JwsOutputStream jwsStream = new JwsOutputStream(actualOs, jwsSignature);
+ byte[] headerBytes = StringUtils.toBytesUTF8(writer.toJson(headers));
+ Base64UrlUtility.encodeAndStream(headerBytes, 0, headerBytes.length, jwsStream);
+ jwsStream.write(new byte[]{'.'});
+
+ Base64UrlOutputStream base64Stream = new Base64UrlOutputStream(jwsStream);
+ ctx.setOutputStream(base64Stream);
+ ctx.proceed();
+ setJoseMediaType(ctx);
+ base64Stream.flush();
+ jwsStream.flush();
+ } else {
+ CachedOutputStream cos = new CachedOutputStream();
+ ctx.setOutputStream(cos);
+ ctx.proceed();
+ JwsCompactProducer p = new JwsCompactProducer(headers, new String(cos.getBytes(), "UTF-8"));
+ setJoseMediaType(ctx);
+ writeJws(p, sigProvider, actualOs);
+ }
+ }
+
+ public void setContentTypeRequired(boolean contentTypeRequired) {
+ this.contentTypeRequired = contentTypeRequired;
+ }
+
+ public void setUseJwsOutputStream(boolean useJwsOutputStream) {
+ this.useJwsOutputStream = useJwsOutputStream;
+ }
+ private void setContentTypeIfNeeded(JoseHeaders headers, WriterInterceptorContext ctx) {
+ if (contentTypeRequired) {
+ MediaType mt = ctx.getMediaType();
+ if (mt != null
+ && !JAXRSUtils.mediaTypeToString(mt).equals(JoseConstants.MEDIA_TYPE_JOSE)) {
+ if ("application".equals(mt.getType())) {
+ headers.setContentType(mt.getSubtype());
+ } else {
+ headers.setContentType(JAXRSUtils.mediaTypeToString(mt));
+ }
+ }
+ }
+ }
+
+ private void setJoseMediaType(WriterInterceptorContext ctx) {
+ MediaType joseMediaType = JAXRSUtils.toMediaType(JoseConstants.MEDIA_TYPE_JOSE);
+ ctx.setMediaType(joseMediaType);
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
new file mode 100644
index 0000000..8f87119
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
@@ -0,0 +1,84 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.IOException;
+
+import javax.annotation.Priority;
+import javax.ws.rs.Priorities;
+import javax.ws.rs.client.ClientRequestContext;
+import javax.ws.rs.client.ClientRequestFilter;
+import javax.ws.rs.core.HttpHeaders;
+
+import org.apache.cxf.common.util.Base64UrlUtility;
+import org.apache.cxf.configuration.security.AuthorizationPolicy;
+import org.apache.cxf.endpoint.Endpoint;
+import org.apache.cxf.jaxrs.utils.JAXRSUtils;
+import org.apache.cxf.rs.security.jose.JoseException;
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jwe.JweHeaders;
+import org.apache.cxf.rs.security.jose.jwt.AbstractJoseJwtProducer;
+import org.apache.cxf.rs.security.jose.jwt.JwtClaims;
+import org.apache.cxf.rs.security.jose.jwt.JwtConstants;
+import org.apache.cxf.rs.security.jose.jwt.JwtToken;
+import org.apache.cxf.rt.security.crypto.CryptoUtils;
+
+@Priority(Priorities.AUTHENTICATION)
+public class JwtAuthenticationClientFilter extends AbstractJoseJwtProducer
+ implements ClientRequestFilter {
+
+ private static final String DEFAULT_AUTH_SCHEME = "JWT";
+ private String authScheme = DEFAULT_AUTH_SCHEME;
+ @Override
+ public void filter(ClientRequestContext requestContext) throws IOException {
+ JwtToken jwt = getJwtToken(requestContext);
+ if (jwt == null && super.isJweRequired()) {
+ AuthorizationPolicy ap = JAXRSUtils.getCurrentMessage().getExchange()
+ .get(Endpoint.class).getEndpointInfo().getExtensor(AuthorizationPolicy.class);
+ if (ap != null && ap.getUserName() != null) {
+ JwtClaims claims = new JwtClaims();
+ claims.setSubject(ap.getUserName());
+ claims.setClaim("password", ap.getPassword());
+ claims.setIssuedAt(System.currentTimeMillis() / 1000);
+ jwt = new JwtToken(new JweHeaders(), claims);
+ }
+ }
+ if (jwt == null) {
+ throw new JoseException("JWT token is not available");
+ }
+ JoseUtils.setJoseMessageContextProperty(jwt.getHeaders(),
+ getContextPropertyValue());
+ String data = super.processJwt(jwt);
+ requestContext.getHeaders().putSingle(HttpHeaders.AUTHORIZATION,
+ authScheme + " " + data);
+ }
+ protected JwtToken getJwtToken(ClientRequestContext requestContext) {
+ return (JwtToken)requestContext.getProperty(JwtConstants.JWT_TOKEN);
+ }
+ protected String getContextPropertyValue() {
+ return Base64UrlUtility.encode(CryptoUtils.generateSecureRandomBytes(16));
+ }
+
+ public void setAuthScheme(String authScheme) {
+ this.authScheme = authScheme;
+ }
+
+
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
new file mode 100644
index 0000000..1cc56c46
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
@@ -0,0 +1,113 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.io.IOException;
+import java.util.logging.Logger;
+
+import javax.annotation.Priority;
+import javax.ws.rs.Priorities;
+import javax.ws.rs.container.ContainerRequestContext;
+import javax.ws.rs.container.ContainerRequestFilter;
+import javax.ws.rs.container.PreMatching;
+import javax.ws.rs.core.HttpHeaders;
+
+import org.apache.cxf.common.logging.LogUtils;
+import org.apache.cxf.jaxrs.utils.JAXRSUtils;
+import org.apache.cxf.rs.security.jose.JoseException;
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jwt.AbstractJoseJwtConsumer;
+import org.apache.cxf.rs.security.jose.jwt.JwtToken;
+import org.apache.cxf.rs.security.jose.jwt.JwtUtils;
+import org.apache.cxf.security.SecurityContext;
+
+@PreMatching
+@Priority(Priorities.AUTHENTICATION)
+public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements ContainerRequestFilter {
+ protected static final Logger LOG = LogUtils.getL7dLogger(JwtAuthenticationFilter.class);
+
+ private static final String DEFAULT_AUTH_SCHEME = "JWT";
+ private String expectedAuthScheme = DEFAULT_AUTH_SCHEME;
+ private int clockOffset;
+ private int ttl;
+ private String roleClaim;
+
+ @Override
+ public void filter(ContainerRequestContext requestContext) throws IOException {
+ String auth = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);
+ String[] parts = auth == null ? null : auth.split(" ");
+ if (parts == null || !expectedAuthScheme.equals(parts[0]) || parts.length != 2) {
+ throw new JoseException(expectedAuthScheme + " scheme is expected");
+ }
+ JwtToken token = super.getJwtToken(parts[1]);
+ JoseUtils.setMessageContextProperty(token.getHeaders());
+
+ SecurityContext securityContext = configureSecurityContext(token);
+ if (securityContext != null) {
+ JAXRSUtils.getCurrentMessage().put(SecurityContext.class, securityContext);
+ }
+
+ }
+
+ protected SecurityContext configureSecurityContext(JwtToken jwt) {
+ return new JwtTokenSecurityContext(jwt, roleClaim);
+ }
+
+
+ public void setExpectedAuthScheme(String expectedAuthScheme) {
+ this.expectedAuthScheme = expectedAuthScheme;
+ }
+
+ @Override
+ protected void validateToken(JwtToken jwt) {
+ // If we have no issued time then we need to have an expiry
+ boolean expiredRequired = jwt.getClaims().getIssuedAt() == null;
+ JwtUtils.validateJwtExpiry(jwt.getClaims(), clockOffset, expiredRequired);
+
+ JwtUtils.validateJwtNotBefore(jwt.getClaims(), clockOffset, false);
+
+ // If we have no expiry then we must have an issued at
+ boolean issuedAtRequired = jwt.getClaims().getExpiryTime() == null;
+ JwtUtils.validateJwtIssuedAt(jwt.getClaims(), ttl, clockOffset, issuedAtRequired);
+ }
+
+ public int getClockOffset() {
+ return clockOffset;
+ }
+
+ public void setClockOffset(int clockOffset) {
+ this.clockOffset = clockOffset;
+ }
+
+ public int getTtl() {
+ return ttl;
+ }
+
+ public void setTtl(int ttl) {
+ this.ttl = ttl;
+ }
+
+ public String getRoleClaim() {
+ return roleClaim;
+ }
+
+ public void setRoleClaim(String roleClaim) {
+ this.roleClaim = roleClaim;
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtTokenSecurityContext.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtTokenSecurityContext.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtTokenSecurityContext.java
new file mode 100644
index 0000000..427ad73
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtTokenSecurityContext.java
@@ -0,0 +1,81 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+import java.security.Principal;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+import javax.security.auth.Subject;
+
+import org.apache.cxf.common.security.SimpleGroup;
+import org.apache.cxf.common.security.SimplePrincipal;
+import org.apache.cxf.rs.security.jose.jwt.JwtToken;
+import org.apache.cxf.security.LoginSecurityContext;
+
+public class JwtTokenSecurityContext implements LoginSecurityContext {
+ private final JwtToken token;
+ private final Principal principal;
+ private final Set<Principal> roles;
+
+ public JwtTokenSecurityContext(JwtToken jwt, String roleClaim) {
+ principal = new SimplePrincipal(jwt.getClaims().getSubject());
+ this.token = jwt;
+ if (roleClaim != null && jwt.getClaims().containsProperty(roleClaim)) {
+ roles = new HashSet<Principal>();
+ String role = jwt.getClaims().getStringProperty(roleClaim).trim();
+ for (String r : role.split(",")) {
+ roles.add(new SimpleGroup(r));
+ }
+ } else {
+ roles = Collections.emptySet();
+ }
+ }
+
+ public JwtToken getToken() {
+ return token;
+ }
+
+ @Override
+ public Subject getSubject() {
+ return null;
+ }
+
+ @Override
+ public Set<Principal> getUserRoles() {
+ return Collections.unmodifiableSet(roles);
+ }
+
+ @Override
+ public Principal getUserPrincipal() {
+ return principal;
+ }
+
+ @Override
+ public boolean isUserInRole(String role) {
+ for (Principal principalRole : roles) {
+ if (principalRole != principal && principalRole.getName().equals(role)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/Priorities.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/Priorities.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/Priorities.java
new file mode 100644
index 0000000..877ff0c
--- /dev/null
+++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/Priorities.java
@@ -0,0 +1,34 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.jaxrs;
+
+public final class Priorities {
+ public static final int JWE_SERVER_READ_PRIORITY = 1001;
+ public static final int JWS_SERVER_READ_PRIORITY = 1002;
+
+ public static final int JWE_WRITE_PRIORITY = 1001;
+ public static final int JWS_WRITE_PRIORITY = 1002;
+
+ public static final int JWE_CLIENT_READ_PRIORITY = 1002;
+ public static final int JWS_CLIENT_READ_PRIORITY = 1001;
+
+ private Priorities() {
+
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/pom.xml
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/pom.xml b/rt/rs/security/jose/pom.xml
index 63e23c4..c94129c 100644
--- a/rt/rs/security/jose/pom.xml
+++ b/rt/rs/security/jose/pom.xml
@@ -7,9 +7,9 @@
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
-
+
http://www.apache.org/licenses/LICENSE-2.0
-
+
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
@@ -20,49 +20,23 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<artifactId>cxf-rt-rs-security-jose</artifactId>
- <packaging>bundle</packaging>
- <name>Apache CXF Runtime JOSE</name>
- <description>Apache CXF Runtime JOSE</description>
+ <packaging>pom</packaging>
+ <name>Apache CXF JOSE Security</name>
+ <description>Apache CXF JOSE Security</description>
<url>http://cxf.apache.org</url>
<parent>
<groupId>org.apache.cxf</groupId>
+<<<<<<< HEAD
<artifactId>cxf-parent</artifactId>
<version>3.0.7-SNAPSHOT</version>
<relativePath>../../../../parent/pom.xml</relativePath>
+=======
+ <artifactId>cxf-rt-rs-security</artifactId>
+ <version>3.1.4-SNAPSHOT</version>
+>>>>>>> 66a8177... Splitting current jose module into jose-core + jose-jaxrs
</parent>
- <dependencies>
- <dependency>
- <groupId>org.apache.cxf</groupId>
- <artifactId>cxf-core</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.cxf</groupId>
- <artifactId>cxf-rt-security</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.cxf</groupId>
- <artifactId>cxf-rt-frontend-jaxrs</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.cxf</groupId>
- <artifactId>cxf-rt-rs-extension-providers</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.bouncycastle</groupId>
- <artifactId>bcprov-ext-jdk15on</artifactId>
- <version>${cxf.bcprov.version}</version>
- <scope>provided</scope>
- <optional>true</optional>
- </dependency>
- <!--test dependencies-->
- <dependency>
- <groupId>junit</groupId>
- <artifactId>junit</artifactId>
- <scope>test</scope>
- </dependency>
- </dependencies>
+ <modules>
+ <module>jose-core</module>
+ <module>jose-jaxrs</module>
+ </modules>
</project>
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseConsumer.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseConsumer.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseConsumer.java
deleted file mode 100644
index 98886ce..0000000
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseConsumer.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose;
-
-import org.apache.cxf.rs.security.jose.jwe.JweDecryptionProvider;
-import org.apache.cxf.rs.security.jose.jwe.JweUtils;
-import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
-import org.apache.cxf.rs.security.jose.jws.JwsUtils;
-
-public abstract class AbstractJoseConsumer {
- private JweDecryptionProvider jweDecryptor;
- private JwsSignatureVerifier jwsVerifier;
-
- public void setJweDecryptor(JweDecryptionProvider jweDecryptor) {
- this.jweDecryptor = jweDecryptor;
- }
-
- public void setJwsVerifier(JwsSignatureVerifier theJwsVerifier) {
- this.jwsVerifier = theJwsVerifier;
- }
-
- protected JweDecryptionProvider getInitializedDecryptionProvider() {
- if (jweDecryptor != null) {
- return jweDecryptor;
- }
- return JweUtils.loadDecryptionProvider(false);
- }
- protected JwsSignatureVerifier getInitializedSignatureVerifier() {
- if (jwsVerifier != null) {
- return jwsVerifier;
- }
- return JwsUtils.loadSignatureVerifier(false);
- }
-
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseProducer.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseProducer.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseProducer.java
deleted file mode 100644
index f506943..0000000
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseProducer.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose;
-
-import org.apache.cxf.rs.security.jose.jwe.JweEncryptionProvider;
-import org.apache.cxf.rs.security.jose.jwe.JweUtils;
-import org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider;
-import org.apache.cxf.rs.security.jose.jws.JwsUtils;
-
-public abstract class AbstractJoseProducer {
- private JwsSignatureProvider sigProvider;
- private JweEncryptionProvider encryptionProvider;
-
- protected JwsSignatureProvider getInitializedSignatureProvider() {
- if (sigProvider != null) {
- return sigProvider;
- }
-
- return JwsUtils.loadSignatureProvider(false);
- }
- protected JweEncryptionProvider getInitializedEncryptionProvider() {
- if (encryptionProvider != null) {
- return encryptionProvider;
- }
- return JweUtils.loadEncryptionProvider(false);
- }
-
- public void setEncryptionProvider(JweEncryptionProvider encryptionProvider) {
- this.encryptionProvider = encryptionProvider;
- }
-
- public void setSignatureProvider(JwsSignatureProvider signatureProvider) {
- this.sigProvider = signatureProvider;
- }
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/JoseConstants.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/JoseConstants.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/JoseConstants.java
deleted file mode 100644
index 0c04791..0000000
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/JoseConstants.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.rs.security.jose;
-
-public final class JoseConstants {
- public static final String HEADER_TYPE = "typ";
- public static final String HEADER_ALGORITHM = "alg";
- public static final String HEADER_CONTENT_TYPE = "cty";
- public static final String HEADER_CRITICAL = "crit";
-
- public static final String HEADER_KEY_ID = "kid";
- public static final String HEADER_X509_URL = "x5u";
- public static final String HEADER_X509_CHAIN = "x5c";
- public static final String HEADER_X509_THUMBPRINT = "x5t";
- public static final String HEADER_X509_THUMBPRINT_SHA256 = "x5t#S256";
- public static final String HEADER_JSON_WEB_KEY = "jwk";
- public static final String HEADER_JSON_WEB_KEY_SET = "jku";
-
- public static final String JWE_HEADER_KEY_ENC_ALGORITHM = HEADER_ALGORITHM;
- public static final String JWE_HEADER_CONTENT_ENC_ALGORITHM = "enc";
- public static final String JWE_HEADER_ZIP_ALGORITHM = "zip";
- public static final String JWE_DEFLATE_ZIP_ALGORITHM = "DEF";
-
- public static final String JWS_HEADER_B64_STATUS_HEADER = "b64";
-
- public static final String TYPE_JWT = "JWT";
- public static final String TYPE_JOSE = "JOSE";
- public static final String TYPE_JOSE_JSON = "JOSE+JSON";
- public static final String MEDIA_TYPE_JOSE = "application/jose";
- public static final String MEDIA_TYPE_JOSE_JSON = "application/jose+json";
-
- public static final String JOSE_CONTEXT_PROPERTY = "org.apache.cxf.jose.context";
-
- private JoseConstants() {
-
- }
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/JoseException.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/JoseException.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/JoseException.java
deleted file mode 100644
index a71a098..0000000
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/JoseException.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose;
-
-public class JoseException extends RuntimeException {
-
- private static final long serialVersionUID = 4118589816228511524L;
- public JoseException() {
-
- }
- public JoseException(String error) {
- super(error);
- }
- public JoseException(Throwable cause) {
- super(cause);
- }
-}