Package org.mockserver.oidc

Class OidcTokenMinter

java.lang.Object
org.mockserver.oidc.OidcTokenMinter
public class OidcTokenMinter extends Object
Mints the OIDC token-endpoint response (access_token, id_token, refresh_token) at request time.

Token minting was moved out of OidcProviderGenerator.generate(org.mockserver.oidc.OidcProviderConfiguration) so that per-request context — most importantly the nonce echoed back from the /authorize request — can be embedded into the id_token. The provider carries its AsymmetricKeyPair (and the JWTGenerator built from it) on OidcAuthorizationStore.Provider; the same key both signs here and is published at the JWKS endpoint, preserving the sign/publish invariant.

Claim split (per OIDC core):

  • id_token — iss, sub, aud=clientId, exp, iat, nbf, nonce (when supplied), profile/email claims for the requested scopes, at_hash, plus additionalClaims. Only issued when the openid scope was requested.
  • access_token — iss, sub, aud=audience, exp, iat, nbf, scope, client_id plus additionalClaims.

  • Constructor Details

  • Method Details

    • verifyAccessToken

      public Map<String,Object> verifyAccessToken(String token)
      Verifies a JWT access token that this minter issued, returning its claims when the token is genuinely valid and null when it is not.

      This is the validation path behind OidcIntrospectionCallback. Introspection previously ignored the presented token entirely for JWT providers and reported active from static configuration, so any string — garbage, expired, tampered or revoked — introspected as active. A test asserting "my application rejects a revoked token" therefore passed while proving nothing. Introspection is a security control, so it must fail closed: anything that does not verify against this provider's signing key, within its validity window, is inactive.

      Checks applied, all of which must pass:

      • the token parses as a JWS and its signature verifies against this provider's key pair (so a token minted by another provider, or one whose signature was tampered with, fails);
      • exp is in the future and nbf/iat are not in the future, allowing CLOCK_SKEW_SECONDS of skew.
      Parameters:
      token - the presented access token
      Returns:
      the token's claims when valid, otherwise null

    • getJwsAlgorithm

      public String getJwsAlgorithm()
      The JWS algorithm this provider signs with, advertised in the discovery document.

    • mintTokenResponse

      public String mintTokenResponse(String requestedScope, String nonce, boolean includeRefresh)
      Mints a token response without a request to derive the issuer from.

      Prefer mintTokenResponse(String, String, boolean, String) whenever a request is available. With no request, OidcIssuerResolver can only fall back to the configured issuer or, when none is configured, to its hardcoded default — which is precisely the value the per-request derivation exists to avoid. This overload is therefore only appropriate off the request path (e.g. a test minting a token directly).

    • mintTokenResponse

      public String mintTokenResponse(String requestedScope, String nonce, boolean includeRefresh, String issuer)
      Mints a token-endpoint response using an explicitly resolved issuer.

      The issuer is passed in rather than read from configuration because it is resolved per request from the Host header (see OidcIssuerResolver) — the iss claim in a minted token must match the issuer advertised by the discovery document, or every conformant relying party rejects the token.

      Parameters:
      issuer - the issuer resolved for this request