Class OIDCSupport

java.lang.Object

org.apache.activemq.artemis.spi.core.security.jaas.oidc.OIDCSupport

public class OIDCSupport
extends Object

Services and helpers used by OIDCLoginModule.

login modules are instantiated on each LoginContext.login(), so this class delegates to XXXAccess interfaces which may provide caching for better performance.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	OIDCSupport.ConfigKey
static final record	OIDCSupport.JWTStringArray	Record for returning values from stringArrayForPath(JWTClaimsSet, String) with indication if the path was correct.

Field Summary

Fields

Modifier and Type	Field	Description
static final org.slf4j.Logger	LOG

Constructor Summary

Constructors

Constructor	Description
OIDCSupport(Map<String,?> options, boolean debug)	Construct a helper object to support single LoginContext.login().

Method Summary

Modifier and Type	Method	Description
static boolean	booleanOption(OIDCSupport.ConfigKey configKey, Map<String,?> options)
com.nimbusds.jose.proc.JWKSecurityContext	currentContext()	Return a SecurityContext with keys recently synchronized with the provider.
static String	getThumbprint(com.nimbusds.jwt.JWTClaimsSet claims)
static String	getTokenSummary(com.nimbusds.jwt.JWTClaimsSet claims)	Having parsed, but not necessarily validated token, this method returns some String reference to identify the token for logging purpose
void	initialize()	Initialize the OIDCSupport, so we can do more configuration after calling the constructor
static int	intOption(OIDCSupport.ConfigKey configKey, Map<String,?> options)
static Map<String,String>	mappingOption(OIDCSupport.ConfigKey configKey, Map<String,?> options)
void	setHttpClientAccess(HttpClientAccess httpClientAccess)
void	setOidcMetadataAccess(OIDCMetadataAccess oidcMetadataAccess)
static OIDCSupport.JWTStringArray	stringArrayForPath(com.nimbusds.jwt.JWTClaimsSet claims, String path)	Handy utility method to extract String array values (single or multi element) from the "claim set" of a JWT token.
static String[]	stringArrayOption(OIDCSupport.ConfigKey configKey, Map<String,?> options)
static String	stringOption(OIDCSupport.ConfigKey configKey, Map<String,?> options)
static boolean	tlsCertificateMatching(X509Certificate[] peerCertificates, com.nimbusds.jwt.JWTClaimsSet claims, boolean debug)	Method which implements RFC 8705 OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

public static final org.slf4j.Logger LOG

Constructor Details

OIDCSupport

public OIDCSupport(Map<String,?> options,
 boolean debug)

Construct a helper object to support single LoginContext.login(). Scoped to the lifetime of a single JAAS login operation.

Parameters:

options - options passed to LoginModule.initialize(Subject, CallbackHandler, Map, Map)

debug - verbosity flag

Method Details

stringOption

public static String stringOption(OIDCSupport.ConfigKey configKey,
 Map<String,?> options)

booleanOption

public static boolean booleanOption(OIDCSupport.ConfigKey configKey,
 Map<String,?> options)

intOption

public static int intOption(OIDCSupport.ConfigKey configKey,
 Map<String,?> options)

stringArrayOption

public static String[] stringArrayOption(OIDCSupport.ConfigKey configKey,
 Map<String,?> options)

mappingOption

public static Map<String,String> mappingOption(OIDCSupport.ConfigKey configKey,
 Map<String,?> options)

initialize

public void initialize()

Initialize the OIDCSupport, so we can do more configuration after calling the constructor

stringArrayForPath

public static OIDCSupport.JWTStringArray stringArrayForPath(com.nimbusds.jwt.JWTClaimsSet claims,
 String path)

Handy utility method to extract String array values (single or multi element) from the "claim set" of a JWT token. Used after basic token validation - mostly to extract roles for fields like realm_access.roles. The extracted value should be a String or String array.

Parameters:

claims - JWTClaimsSet for a JWT

path - JSON path for extracting specific values from the token

Returns:

OIDCSupport.JWTStringArray with the extracted value and the flag for marking if the value was found

tlsCertificateMatching

public static boolean tlsCertificateMatching(X509Certificate[] peerCertificates,
 com.nimbusds.jwt.JWTClaimsSet claims,
 boolean debug)

Method which implements RFC 8705 OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens. The JWT should contain cnf/x5t#256 field matching the SHA-256 of a certificate from the transport layer.

Parameters:

peerCertificates - X.509 certificate for (client) peer certificates

claims - JWTClaimsSet from the token which doesn't have to be fully validated (yet)

debug - verbose flag

Returns:

whether the cnf/x5t#256 matches SHA256 digest of the peer certificate

getThumbprint

public static String getThumbprint(com.nimbusds.jwt.JWTClaimsSet claims)

getTokenSummary

public static String getTokenSummary(com.nimbusds.jwt.JWTClaimsSet claims)

Having parsed, but not necessarily validated token, this method returns some String reference to identify the token for logging purpose

Parameters:

claims - token claims to investigate

Returns:

some information from the token for logging purpose

setHttpClientAccess

public void setHttpClientAccess(HttpClientAccess httpClientAccess)

setOidcMetadataAccess

public void setOidcMetadataAccess(OIDCMetadataAccess oidcMetadataAccess)

currentContext

public com.nimbusds.jose.proc.JWKSecurityContext currentContext()

Return a SecurityContext with keys recently synchronized with the provider.

Returns:

JWKSecurityContext with currently known public keys