Package org.apache.kafka.common.security.oauthbearer.secured

Class RefreshingHttpsJwksVerificationKeyResolver

java.lang.Object
org.apache.kafka.common.security.oauthbearer.secured.RefreshingHttpsJwksVerificationKeyResolver
All Implemented Interfaces:
Closeable, AutoCloseable, CloseableVerificationKeyResolver, Initable, org.jose4j.keys.resolvers.VerificationKeyResolver
public class RefreshingHttpsJwksVerificationKeyResolver extends Object implements CloseableVerificationKeyResolver
RefreshingHttpsJwksVerificationKeyResolver is a VerificationKeyResolver implementation that will periodically refresh the JWKS using its HttpsJwks instance. A JWKS (JSON Web Key Set) is a JSON document provided by the OAuth/OIDC provider that lists the keys used to sign the JWTs it issues. Here is a sample JWKS JSON document: 
 {
   "keys": [
     {
       "kty": "RSA",
       "alg": "RS256",
       "kid": "abc123",
       "use": "sig",
       "e": "AQAB",
       "n": "..."
     },
     {
       "kty": "RSA",
       "alg": "RS256",
       "kid": "def456",
       "use": "sig",
       "e": "AQAB",
       "n": "..."
     }
   ]
 }
Without going into too much detail, the array of keys enumerates the key data that the provider is using to sign the JWT. The key ID (kid) is referenced by the JWT's header in order to match up the JWT's signing key with the key in the JWKS. During the validation step of the broker, the jose4j OAuth library will use the contents of the appropriate key in the JWKS to validate the signature. Given that the JWKS is referenced by the JWT, the JWKS must be made available by the OAuth/OIDC provider so that a JWT can be validated.
See Also:

  • Constructor Details

    • RefreshingHttpsJwksVerificationKeyResolver

      public RefreshingHttpsJwksVerificationKeyResolver(RefreshingHttpsJwks refreshingHttpsJwks)

  • Method Details

    • init

      public void init() throws IOException
      Description copied from interface: Initable
      Lifecycle method to perform any one-time initialization of the retriever. This must be performed by the caller to ensure the correct state before methods are invoked.
      Specified by:
      init in interface Initable
      Throws:
      IOException - Thrown on errors related to IO during initialization

    • close

      public void close()
      Description copied from interface: CloseableVerificationKeyResolver
      Lifecycle method to perform a clean shutdown of the VerificationKeyResolver. This must be performed by the caller to ensure the correct state, freeing up and releasing any resources performed in Initable.init().
      Specified by:
      close in interface AutoCloseable
      Specified by:
      close in interface Closeable
      Specified by:
      close in interface CloseableVerificationKeyResolver

    • resolveKey

      public Key resolveKey(org.jose4j.jws.JsonWebSignature jws, List<org.jose4j.jwx.JsonWebStructure> nestingContext) throws org.jose4j.lang.UnresolvableKeyException
      Specified by:
      resolveKey in interface org.jose4j.keys.resolvers.VerificationKeyResolver
      Throws:
      org.jose4j.lang.UnresolvableKeyException