Package org.apache.kafka.common.security.oauthbearer.secured

Class JwksFileVerificationKeyResolver

java.lang.Object
org.apache.kafka.common.security.oauthbearer.secured.JwksFileVerificationKeyResolver
All Implemented Interfaces:
Closeable, AutoCloseable, CloseableVerificationKeyResolver, Initable, org.jose4j.keys.resolvers.VerificationKeyResolver
public class JwksFileVerificationKeyResolver extends Object implements CloseableVerificationKeyResolver
JwksFileVerificationKeyResolver is a VerificationKeyResolver implementation that will load the JWKS from the given file system directory. A JWKS (JSON Web Key Set) is a JSON document provided by the OAuth/OIDC provider that lists the keys used to sign the JWTs it issues. Here is a sample JWKS JSON document: 
 {
   "keys": [
     {
       "kty": "RSA",
       "alg": "RS256",
       "kid": "abc123",
       "use": "sig",
       "e": "AQAB",
       "n": "..."
     },
     {
       "kty": "RSA",
       "alg": "RS256",
       "kid": "def456",
       "use": "sig",
       "e": "AQAB",
       "n": "..."
     }
   ]
 }
Without going into too much detail, the array of keys enumerates the key data that the provider is using to sign the JWT. The key ID (kid) is referenced by the JWT's header in order to match up the JWT's signing key with the key in the JWKS. During the validation step of the broker, the jose4j OAuth library will use the contents of the appropriate key in the JWKS to validate the signature. Given that the JWKS is referenced by the JWT, the JWKS must be made available by the OAuth/OIDC provider so that a JWT can be validated.
See Also:

  • Constructor Details

    • JwksFileVerificationKeyResolver

      public JwksFileVerificationKeyResolver(Path jwksFile)

  • Method Details

    • init

      public void init() throws IOException
      Description copied from interface: Initable
      Lifecycle method to perform any one-time initialization of the retriever. This must be performed by the caller to ensure the correct state before methods are invoked.
      Specified by:
      init in interface Initable
      Throws:
      IOException - Thrown on errors related to IO during initialization

    • resolveKey

      public Key resolveKey(org.jose4j.jws.JsonWebSignature jws, List<org.jose4j.jwx.JsonWebStructure> nestingContext) throws org.jose4j.lang.UnresolvableKeyException
      Specified by:
      resolveKey in interface org.jose4j.keys.resolvers.VerificationKeyResolver
      Throws:
      org.jose4j.lang.UnresolvableKeyException