You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2015/10/09 16:07:30 UTC
[1/4] cxf git commit: Minor change to last commit
Repository: cxf
Updated Branches:
refs/heads/master 08fbde3d6 -> 25c187e27
Minor change to last commit
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/25c187e2
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/25c187e2
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/25c187e2
Branch: refs/heads/master
Commit: 25c187e270e0b0b7c1b03e95a1b778abc3c4ac7a
Parents: 6041c03
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Fri Oct 9 15:05:37 2015 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Fri Oct 9 15:07:26 2015 +0100
----------------------------------------------------------------------
.../cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/25c187e2/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
index 269a8d4..cc14a85 100644
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
+++ b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
@@ -45,7 +45,7 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements
private static final String DEFAULT_AUTH_SCHEME = "JWT";
private String expectedAuthScheme = DEFAULT_AUTH_SCHEME;
private int ttl = 300;
- private int futureTTL = 0;
+ private int futureTTL;
@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
@@ -73,7 +73,9 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements
// If we have no expiry then we must have an issued at
boolean issuedAtRequired = jwt.getClaims().getExpiryTime() == null;
- JwtUtils.validateJwtTTL(jwt.getClaims(), ttl, issuedAtRequired);
+ if (issuedAtRequired) {
+ JwtUtils.validateJwtTTL(jwt.getClaims(), ttl, issuedAtRequired);
+ }
}
public int getTtl() {
[3/4] cxf git commit: Enable automatic processing of expiry / ttl for
JWT tokens
Posted by co...@apache.org.
Enable automatic processing of expiry / ttl for JWT tokens
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/6041c039
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/6041c039
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/6041c039
Branch: refs/heads/master
Commit: 6041c0399c35eb8c236b3d1b998b538599ef4388
Parents: f10030b
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Fri Oct 9 15:03:15 2015 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Fri Oct 9 15:07:26 2015 +0100
----------------------------------------------------------------------
.../jose/jaxrs/JwtAuthenticationFilter.java | 31 ++++++++
.../cxf/rs/security/jose/jwt/JwtUtils.java | 79 ++++++++++++++++----
2 files changed, 94 insertions(+), 16 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/6041c039/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
index 408ce20..269a8d4 100644
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
+++ b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
@@ -34,6 +34,7 @@ import org.apache.cxf.rs.security.jose.JoseException;
import org.apache.cxf.rs.security.jose.JoseUtils;
import org.apache.cxf.rs.security.jose.jwt.AbstractJoseJwtConsumer;
import org.apache.cxf.rs.security.jose.jwt.JwtToken;
+import org.apache.cxf.rs.security.jose.jwt.JwtUtils;
import org.apache.cxf.security.SecurityContext;
@PreMatching
@@ -43,6 +44,8 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements
private static final String DEFAULT_AUTH_SCHEME = "JWT";
private String expectedAuthScheme = DEFAULT_AUTH_SCHEME;
+ private int ttl = 300;
+ private int futureTTL = 0;
@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
@@ -60,4 +63,32 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements
this.expectedAuthScheme = expectedAuthScheme;
}
+ @Override
+ protected void validateToken(JwtToken jwt) {
+ // If we have no issued time then we need to have an expiry
+ boolean expiredRequired = jwt.getClaims().getIssuedAt() == null;
+ JwtUtils.validateJwtExpiry(jwt.getClaims(), expiredRequired);
+
+ JwtUtils.validateJwtNotBefore(jwt.getClaims(), futureTTL, false);
+
+ // If we have no expiry then we must have an issued at
+ boolean issuedAtRequired = jwt.getClaims().getExpiryTime() == null;
+ JwtUtils.validateJwtTTL(jwt.getClaims(), ttl, issuedAtRequired);
+ }
+
+ public int getTtl() {
+ return ttl;
+ }
+
+ public void setTtl(int ttl) {
+ this.ttl = ttl;
+ }
+
+ public int getFutureTTL() {
+ return futureTTL;
+ }
+
+ public void setFutureTTL(int futureTTL) {
+ this.futureTTL = futureTTL;
+ }
}
http://git-wip-us.apache.org/repos/asf/cxf/blob/6041c039/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java
index c846659..64c24e9 100644
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java
+++ b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/JwtUtils.java
@@ -18,6 +18,7 @@
*/
package org.apache.cxf.rs.security.jose.jwt;
+import java.util.Date;
public final class JwtUtils {
private JwtUtils() {
@@ -36,27 +37,73 @@ public final class JwtUtils {
return new JwtTokenReaderWriter().fromJsonClaims(json);
}
- public static void validateJwtTimeClaims(JwtClaims claims, int clockOffset,
- int issuedAtRange, boolean claimsRequired) {
- Long currentTimeInSecs = System.currentTimeMillis() / 1000;
- Long expiryTimeInSecs = claims.getExpiryTime();
- if (expiryTimeInSecs == null && claimsRequired
- || expiryTimeInSecs != null && currentTimeInSecs > expiryTimeInSecs) {
- throw new JwtException("The token expired");
+ public static void validateJwtExpiry(JwtClaims claims, boolean claimRequired) {
+ Long expiryTime = claims.getExpiryTime();
+ if (expiryTime == null) {
+ if (claimRequired) {
+ throw new JwtException("The token has expired");
+ }
+ return;
}
- Long issuedAtInSecs = claims.getIssuedAt();
- if (clockOffset <= 0) {
- clockOffset = 0;
+
+ Date rightNow = new Date();
+ Date expiresDate = new Date(expiryTime * 1000L);
+ if (expiresDate.before(rightNow)) {
+ throw new JwtException("The token has expired");
}
- if (issuedAtInSecs == null && claimsRequired
- || issuedAtInSecs != null && (issuedAtInSecs - clockOffset > currentTimeInSecs || issuedAtRange > 0
- && issuedAtInSecs < currentTimeInSecs - issuedAtRange)) {
- throw new JwtException("Invalid issuedAt");
+ }
+
+ public static void validateJwtNotBefore(JwtClaims claims, int futureTimeToLive, boolean claimRequired) {
+ Long notBeforeTime = claims.getNotBefore();
+
+ // If no NotBefore then just use the IssueAt if it exists
+ if (notBeforeTime == null && claims.getIssuedAt() != null) {
+ notBeforeTime = claims.getIssuedAt();
+ }
+
+ if (notBeforeTime == null && claimRequired) {
+ throw new JwtException("The token cannot be accepted yet");
+ }
+
+ Date validCreation = new Date();
+ long currentTime = validCreation.getTime();
+ if (futureTimeToLive > 0) {
+ validCreation.setTime(currentTime + (long)futureTimeToLive * 1000L);
+ }
+ Date createdDate = new Date(notBeforeTime * 1000L);
+
+ // Check to see if the not before time is in the future
+ if (createdDate.after(validCreation)) {
+ throw new JwtException("The token cannot be accepted yet");
}
}
- public static void validateJwtTimeClaims(JwtClaims claims) {
- validateJwtTimeClaims(claims, 0, 0, false);
+ public static void validateJwtTTL(JwtClaims claims, int timeToLive, boolean claimRequired) {
+ Long issuedAtInSecs = claims.getIssuedAt();
+ if (issuedAtInSecs == null) {
+ if (claimRequired) {
+ throw new JwtException("Invalid issuedAt");
+ }
+ return;
+ }
+
+ Date validCreation = new Date();
+ Date createdDate = new Date(issuedAtInSecs * 1000L);
+
+ int ttl = timeToLive;
+ if (ttl <= 0) {
+ ttl = 300;
+ }
+
+ // Calculate the time that is allowed for the message to travel
+ long currentTime = validCreation.getTime();
+ currentTime -= (long)ttl * 1000L;
+ validCreation.setTime(currentTime);
+
+ // Validate the time it took the message to travel
+ if (createdDate.before(validCreation)) {
+ throw new JwtException("Invalid issuedAt");
+ }
}
}
[2/4] cxf git commit: Remove JwtJwsAuthenticationFilter
Posted by co...@apache.org.
Remove JwtJwsAuthenticationFilter
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/f10030be
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/f10030be
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/f10030be
Branch: refs/heads/master
Commit: f10030bec0ccc0a6bd8ccb890800d91d664e83d1
Parents: aad9d04
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Fri Oct 9 12:07:13 2015 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Fri Oct 9 15:07:26 2015 +0100
----------------------------------------------------------------------
.../jose/jaxrs/JwtAuthenticationFilter.java | 22 ++-----
.../jose/jaxrs/JwtJwsAuthenticationFilter.java | 69 --------------------
2 files changed, 5 insertions(+), 86 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/f10030be/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
index c0c4e02..408ce20 100644
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
+++ b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
@@ -29,8 +29,6 @@ import javax.ws.rs.container.PreMatching;
import javax.ws.rs.core.HttpHeaders;
import org.apache.cxf.common.logging.LogUtils;
-import org.apache.cxf.common.security.SimplePrincipal;
-import org.apache.cxf.common.security.SimpleSecurityContext;
import org.apache.cxf.jaxrs.utils.JAXRSUtils;
import org.apache.cxf.rs.security.jose.JoseException;
import org.apache.cxf.rs.security.jose.JoseUtils;
@@ -53,23 +51,13 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements
if (parts == null || !expectedAuthScheme.equals(parts[0]) || parts.length != 2) {
throw new JoseException(expectedAuthScheme + " scheme is expected");
}
- JwtToken jwt = super.getJwtToken(parts[1]);
- JoseUtils.setMessageContextProperty(jwt.getHeaders());
- JAXRSUtils.getCurrentMessage().put(SecurityContext.class,
- new SimpleSecurityContext(new JwtPrincipal(jwt)));
+ JwtToken token = super.getJwtToken(parts[1]);
+ JoseUtils.setMessageContextProperty(token.getHeaders());
+ JAXRSUtils.getCurrentMessage().put(SecurityContext.class, new JwtTokenSecurityContext(token));
}
+
public void setExpectedAuthScheme(String expectedAuthScheme) {
this.expectedAuthScheme = expectedAuthScheme;
}
- public static class JwtPrincipal extends SimplePrincipal {
- private static final long serialVersionUID = 1L;
- private JwtToken jwt;
- public JwtPrincipal(JwtToken jwt) {
- super(jwt.getClaims().getSubject());
- this.jwt = jwt;
- }
- public JwtToken getJwt() {
- return jwt;
- }
- }
+
}
http://git-wip-us.apache.org/repos/asf/cxf/blob/f10030be/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtJwsAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtJwsAuthenticationFilter.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtJwsAuthenticationFilter.java
deleted file mode 100644
index e495104..0000000
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtJwsAuthenticationFilter.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jaxrs;
-
-import java.io.IOException;
-
-import javax.annotation.Priority;
-import javax.ws.rs.container.ContainerRequestContext;
-import javax.ws.rs.container.ContainerRequestFilter;
-import javax.ws.rs.container.PreMatching;
-import javax.ws.rs.core.HttpHeaders;
-
-import org.apache.cxf.jaxrs.utils.JAXRSUtils;
-import org.apache.cxf.message.Message;
-import org.apache.cxf.rs.security.jose.JoseException;
-import org.apache.cxf.rs.security.jose.jws.JwsCompactConsumer;
-import org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer;
-import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
-import org.apache.cxf.rs.security.jose.jwt.JwtToken;
-import org.apache.cxf.security.SecurityContext;
-
-@PreMatching
-@Priority(Priorities.JWS_SERVER_READ_PRIORITY)
-public class JwtJwsAuthenticationFilter extends AbstractJwsReaderProvider implements ContainerRequestFilter {
- private static final String JWS_CONTEXT_PROPERTY = "org.apache.cxf.jws.context";
- private static final String JWT_SCHEME_PROPERTY = "JWT";
- @Override
- public void filter(ContainerRequestContext context) throws IOException {
- String authHeader = context.getHeaderString(HttpHeaders.AUTHORIZATION);
- String[] schemeData = authHeader.split(" ");
- if (schemeData.length != 2 || !JWT_SCHEME_PROPERTY.equals(schemeData[0])) {
- throw new JoseException("JWT scheme is expected");
- }
-
- JwsJwtCompactConsumer p = new JwsJwtCompactConsumer(schemeData[1]);
- JwsSignatureVerifier theSigVerifier = getInitializedSigVerifier(p.getJwsHeaders());
- if (!p.verifySignatureWith(theSigVerifier)) {
- context.abortWith(JAXRSUtils.toResponse(400));
- return;
- }
- Message m = JAXRSUtils.getCurrentMessage();
- setRequestContextProperty(m, p);
- JwtToken token = p.getJwtToken();
- m.put(SecurityContext.class, new JwtTokenSecurityContext(token));
-
- }
- protected void setRequestContextProperty(Message m, JwsCompactConsumer c) {
- Object headerContext = c.getJwsHeaders().getHeader(JWS_CONTEXT_PROPERTY);
- if (headerContext != null) {
- m.put(JWS_CONTEXT_PROPERTY, headerContext);
- }
- }
-}
[4/4] cxf git commit: Don't configure the decryption stuff if not
required
Posted by co...@apache.org.
Don't configure the decryption stuff if not required
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/aad9d04b
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/aad9d04b
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/aad9d04b
Branch: refs/heads/master
Commit: aad9d04b3598b1c4b6910accb61130c06ab250c2
Parents: 08fbde3
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Fri Oct 9 12:06:39 2015 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Fri Oct 9 15:07:26 2015 +0100
----------------------------------------------------------------------
.../jose/jwt/AbstractJoseJwtConsumer.java | 36 ++++++++++++--------
1 file changed, 22 insertions(+), 14 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/aad9d04b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/AbstractJoseJwtConsumer.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/AbstractJoseJwtConsumer.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/AbstractJoseJwtConsumer.java
index 4de976d..d4cdf48 100644
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/AbstractJoseJwtConsumer.java
+++ b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/AbstractJoseJwtConsumer.java
@@ -38,29 +38,37 @@ public abstract class AbstractJoseJwtConsumer extends AbstractJoseConsumer {
if (!isJwsRequired() && !isJweRequired()) {
throw new JwtException("Unable to process JWT");
}
- if (jweDecryptor == null) {
- jweDecryptor = getInitializedDecryptionProvider();
- }
- if (jweDecryptor != null) {
+
+ if (isJweRequired()) {
+ if (jweDecryptor == null) {
+ jweDecryptor = getInitializedDecryptionProvider();
+ }
+ if (jweDecryptor == null) {
+ throw new JwtException("Unable to decrypt JWT");
+ }
+
if (!isJwsRequired()) {
return new JweJwtCompactConsumer(wrappedJwtToken).decryptWith(jweDecryptor);
}
wrappedJwtToken = jweDecryptor.decrypt(wrappedJwtToken).getContentText();
- } else if (isJweRequired()) {
- throw new JwtException("Unable to decrypt JWT");
}
+
JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(wrappedJwtToken);
JwtToken jwt = jwtConsumer.getJwtToken();
- if (theSigVerifier == null) {
- theSigVerifier = getInitializedSignatureVerifier(jwt);
- }
- if (theSigVerifier == null && isJwsRequired()) {
- throw new JwtException("Unable to validate JWT");
- }
- if (!jwtConsumer.verifySignatureWith(theSigVerifier)) {
- throw new JwtException("Invalid Signature");
+ if (isJwsRequired()) {
+ if (theSigVerifier == null) {
+ theSigVerifier = getInitializedSignatureVerifier(jwt);
+ }
+ if (theSigVerifier == null) {
+ throw new JwtException("Unable to validate JWT");
+ }
+
+ if (!jwtConsumer.verifySignatureWith(theSigVerifier)) {
+ throw new JwtException("Invalid Signature");
+ }
}
+
validateToken(jwt);
return jwt;
}