Package edu.internet2.middleware.grouper.authentication

Class GrouperOAuthSigningKey

java.lang.Object

edu.internet2.middleware.grouper.authentication.GrouperOAuthSigningKey

public class GrouperOAuthSigningKey
extends Object

Manages the server RSA key pair for signing and verifying OAuth JWT access tokens. Key pair is stored in grouper.properties (database-backed config). The private key is auto-encrypted by the config framework because the key name contains "private" (see GrouperConfigHibernate.isPasswordHelper()).

Constructor Summary

Constructors

Constructor	Description
GrouperOAuthSigningKey()

Method Summary

Modifier and Type	Method	Description
static String	createSignedJwt(String issuer, String subjectId, String subjectSourceId, String clientId, String consentDetails)	Create a signed JWT access token
static RSAPublicKey	getPublicKey()	Get the public key (for JWKS endpoint, etc.)
static void	initializeIfNeeded()	force re-read of keys from config on next access
static com.auth0.jwt.interfaces.DecodedJWT	verifyAndDecodeJwt(String jwt)	Verify and decode a JWT access token
static boolean	verifyKeyPair()	Verify that the public and private keys in config form a valid pair by signing and verifying a test JWT.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

GrouperOAuthSigningKey

public GrouperOAuthSigningKey()

Method Details

getPublicKey

public static RSAPublicKey getPublicKey()

Get the public key (for JWKS endpoint, etc.)

Returns:

the RSA public key

initializeIfNeeded

public static void initializeIfNeeded()

force re-read of keys from config on next access

createSignedJwt

public static String createSignedJwt(String issuer,
 String subjectId,
 String subjectSourceId,
 String clientId,
 String consentDetails)

Create a signed JWT access token

Parameters:

issuer - the issuer URL

subjectId - the Grouper subject ID

subjectSourceId - the Grouper subject source ID

clientId - the OAuth client ID

consentDetails - JSON string with granted scopes from consent, or null

Returns:

the signed JWT string

verifyKeyPair

public static boolean verifyKeyPair()

Verify that the public and private keys in config form a valid pair by signing and verifying a test JWT. Call from GSH to diagnose MCP authentication issues. Prints results to stdout for easy use in GSH.

Returns:

true if the keys match

verifyAndDecodeJwt

public static com.auth0.jwt.interfaces.DecodedJWT verifyAndDecodeJwt(String jwt)

Verify and decode a JWT access token

Parameters:

jwt - the JWT string

Returns:

the decoded JWT, or null if invalid