Package org.apache.kafka.common.security.oauthbearer.secured

Class LoginAccessTokenValidator

java.lang.Object

org.apache.kafka.common.security.oauthbearer.secured.LoginAccessTokenValidator

All Implemented Interfaces:

AccessTokenValidator

public class LoginAccessTokenValidator
extends Object
implements AccessTokenValidator

LoginAccessTokenValidator is an implementation of AccessTokenValidator that is used by the client to perform some rudimentary validation of the JWT access token that is received as part of the response from posting the client credentials to the OAuth/OIDC provider's token endpoint. The validation steps performed are:

1. Basic structural validation of the b64token value as defined in RFC 6750 Section 2.1
2. Basic conversion of the token into an in-memory map
3. Presence of scope, exp, subject, and iat claims

Field Summary

Fields

Modifier and Type	Field	Description
static final String	EXPIRATION_CLAIM_NAME
static final String	ISSUED_AT_CLAIM_NAME

Constructor Summary

Constructors

Constructor	Description
LoginAccessTokenValidator(String scopeClaimName, String subClaimName)	Creates a new LoginAccessTokenValidator that will be used by the client for lightweight validation of the JWT.

Method Summary

Modifier and Type	Method	Description
OAuthBearerToken	validate(String accessToken)	Accepts an OAuth JWT access token in base-64 encoded format, validates, and returns an OAuthBearerToken.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

EXPIRATION_CLAIM_NAME

public static final String EXPIRATION_CLAIM_NAME

See Also:

• Constant Field Values

ISSUED_AT_CLAIM_NAME

public static final String ISSUED_AT_CLAIM_NAME

See Also:

• Constant Field Values

Constructor Details

LoginAccessTokenValidator

public LoginAccessTokenValidator(String scopeClaimName,
 String subClaimName)

Creates a new LoginAccessTokenValidator that will be used by the client for lightweight validation of the JWT.

Parameters:

scopeClaimName - Name of the scope claim to use; must be non-null

subClaimName - Name of the subject claim to use; must be non-null

Method Details

validate

public OAuthBearerToken validate(String accessToken)
                          throws ValidateException

Accepts an OAuth JWT access token in base-64 encoded format, validates, and returns an OAuthBearerToken.

Specified by:

validate in interface AccessTokenValidator

Parameters:

accessToken - Non-null JWT access token

Returns:

OAuthBearerToken

Throws:

ValidateException - Thrown on errors performing validation of given token