Package org.mockserver.authentication.oidc

Class OidcJWTClaimsVerifier

java.lang.Object

com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier<com.nimbusds.jose.proc.SecurityContext>

org.mockserver.authentication.jwt.CustomJWTClaimsVerifier

org.mockserver.authentication.oidc.OidcJWTClaimsVerifier

All Implemented Interfaces:

com.nimbusds.jwt.proc.ClockSkewAware, com.nimbusds.jwt.proc.JWTClaimsSetVerifier<com.nimbusds.jose.proc.SecurityContext>

public class OidcJWTClaimsVerifier
extends CustomJWTClaimsVerifier

Extends CustomJWTClaimsVerifier (which already enforces audience, exp/nbf with skew, required claims and exact-match claims) to additionally assert, for an external OIDC IdP:

• the iss claim equals the configured issuer, and
• the token's granted scopes (parsed from the configured scope claim) contain every required scope.

Issuer and scope checks run BEFORE delegating to the superclass so a wrong issuer or insufficient scope is reported with a precise message.

The exp claim is REQUIRED (passed as a required claim to the superclass): nimbus only checks expiry when the claim is present, so without this a token minted with no exp would be accepted forever. A real OIDC token always carries exp, so requiring it is secure-by-default with no legitimate downside.

Field Summary

Fields inherited from class com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier

DEFAULT_MAX_CLOCK_SKEW_SECONDS

Constructor Summary

Constructors

Constructor	Description
OidcJWTClaimsVerifier(String expectedAudience, String expectedIssuer, String scopeClaim, Set<String> requiredScopes)

Method Summary

Modifier and Type	Method	Description
void	verify(com.nimbusds.jwt.JWTClaimsSet claimsSet, com.nimbusds.jose.proc.SecurityContext context)

Methods inherited from class com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier

currentTime, getAcceptedAudienceValues, getExactMatchClaims, getMaxClockSkew, getProhibitedClaims, getRequiredClaims, setMaxClockSkew

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

OidcJWTClaimsVerifier

public OidcJWTClaimsVerifier(String expectedAudience,
 String expectedIssuer,
 String scopeClaim,
 Set<String> requiredScopes)

Method Details

verify

public void verify(com.nimbusds.jwt.JWTClaimsSet claimsSet,
 com.nimbusds.jose.proc.SecurityContext context)
            throws com.nimbusds.jwt.proc.BadJWTException

Specified by:

verify in interface com.nimbusds.jwt.proc.JWTClaimsSetVerifier<com.nimbusds.jose.proc.SecurityContext>

Overrides:

verify in class CustomJWTClaimsVerifier

Throws:

com.nimbusds.jwt.proc.BadJWTException