StephanRichter/LightOidc
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Wiki Activity

working on implementation using jose library

Browse Source 
Signed-off-by: Stephan Richter <s.richter@srsoftware.de>
This commit is contained in:
Stephan Richter
2024-07-29 09:10:49 +02:00
parent 252252a9d1
commit 3923b855fb
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
de.srsoftware.oidc.backend/src/main/java/de/srsoftware/oidc/backend/TokenController.java
View File

@@ -11,6 +11,7 @@ import de.srsoftware.oidc.api.Client;
import de.srsoftware.oidc.api.ClientService; import de.srsoftware.oidc.api.ClientService;
import de.srsoftware.oidc.api.PathHandler; import de.srsoftware.oidc.api.PathHandler;
import java.io.IOException; import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.*; import java.util.*;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import org.jose4j.jwk.RsaJsonWebKey; import org.jose4j.jwk.RsaJsonWebKey;
@@ -18,6 +19,7 @@ import org.jose4j.jwk.RsaJwkGenerator;
import org.jose4j.jws.AlgorithmIdentifiers; import org.jose4j.jws.AlgorithmIdentifiers;
import org.jose4j.jws.JsonWebSignature; import org.jose4j.jws.JsonWebSignature;
import org.jose4j.jwt.JwtClaims; import org.jose4j.jwt.JwtClaims;
import org.jose4j.keys.HmacKey;
import org.jose4j.lang.JoseException; import org.jose4j.lang.JoseException;
import org.json.JSONObject; import org.json.JSONObject;
@@ -75,8 +77,8 @@ public class TokenController extends PathHandler {
private String createJWT(Client client) { private String createJWT(Client client) {
try { try {
RsaJsonWebKey rsaJsonWebKey = RsaJwkGenerator.generateJwk(2048); HmacKey hmacKey = new HmacKey(client.secret().getBytes(StandardCharsets.UTF_8));
rsaJsonWebKey.setKeyId("k1");
JwtClaims claims = new JwtClaims(); JwtClaims claims = new JwtClaims();
claims.setIssuer("Issuer"); // who creates the token and signs it claims.setIssuer("Issuer"); // who creates the token and signs it
claims.setAudience("Audience"); // to whom the token is intended to be sent claims.setAudience("Audience"); // to whom the token is intended to be sent
@@ -93,9 +95,8 @@ public class TokenController extends PathHandler {
// In this example it is a JWS so we create a JsonWebSignature object. // In this example it is a JWS so we create a JsonWebSignature object.
JsonWebSignature jws = new JsonWebSignature(); JsonWebSignature jws = new JsonWebSignature();
jws.setPayload(claims.toJson()); jws.setPayload(claims.toJson());
jws.setKey(rsaJsonWebKey.getPrivateKey()); jws.setKey(hmacKey);
jws.setKeyIdHeaderValue(rsaJsonWebKey.getKeyId()); jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.HMAC_SHA256);
jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
return jws.getCompactSerialization(); return jws.getCompactSerialization();
} catch (JoseException e) { } catch (JoseException e) {
throw new RuntimeException(e); throw new RuntimeException(e);