001/*
002 * oauth2-oidc-sdk
003 *
004 * Copyright 2012-2020, Connect2id Ltd and contributors.
005 *
006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use
007 * this file except in compliance with the License. You may obtain a copy of the
008 * License at
009 *
010 *    http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software distributed
013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the
015 * specific language governing permissions and limitations under the License.
016 */
017
018package com.nimbusds.oauth2.sdk.dpop;
019
020
021import java.net.URI;
022import java.security.Provider;
023import java.util.Date;
024
025import com.nimbusds.jose.JOSEException;
026import com.nimbusds.jose.JWSAlgorithm;
027import com.nimbusds.jose.JWSHeader;
028import com.nimbusds.jose.JWSSigner;
029import com.nimbusds.jose.crypto.factories.DefaultJWSSignerFactory;
030import com.nimbusds.jose.jwk.JWK;
031import com.nimbusds.jwt.JWTClaimsSet;
032import com.nimbusds.jwt.SignedJWT;
033import com.nimbusds.oauth2.sdk.id.JWTID;
034import com.nimbusds.oauth2.sdk.token.AccessToken;
035import com.nimbusds.openid.connect.sdk.Nonce;
036
037
038/**
039 * Default DPoP proof factory.
040 */
041public class DefaultDPoPProofFactory implements DPoPProofFactory {
042        
043        
044        /**
045         * The public signing JWK.
046         */
047        private final JWK publicJWK;
048        
049        
050        /**
051         * The signing JWS algorithm.
052         */
053        private final JWSAlgorithm jwsAlg;
054        
055        
056        /**
057         * The JWS signer.
058         */
059        private final JWSSigner jwsSigner;
060        
061        
062        /**
063         * Creates a new DPoP proof factory using the default JCA provider.
064         *
065         * @param jwk    The signing JWK. Must not be {@code null}.
066         * @param jwsAlg The signing JWS algorithm. Must not be {@code null}.
067         *
068         * @throws JOSEException If signer creation failed.
069         */
070        public DefaultDPoPProofFactory(final JWK jwk, final JWSAlgorithm jwsAlg)
071                throws JOSEException {
072                
073                this(jwk, jwsAlg, null);
074        }
075        
076        
077        /**
078         * Creates a new DPoP proof factory.
079         *
080         * @param jwk         The signing JWK. Must not be {@code null}.
081         * @param jwsAlg      The signing JWS algorithm. Must not be
082         *                    {@code null}.
083         * @param jcaProvider The JCA provider to use for signing, {@code null}
084         *                    to use the default.
085         *
086         * @throws JOSEException If signer creation failed.
087         */
088        public DefaultDPoPProofFactory(final JWK jwk, final JWSAlgorithm jwsAlg, final Provider jcaProvider)
089                throws JOSEException {
090                
091                if (! jwk.isPrivate()) {
092                        throw new IllegalArgumentException("The JWK must include private parameters");
093                }
094                
095                if (! JWSAlgorithm.Family.SIGNATURE.contains(jwsAlg)) {
096                        throw new IllegalArgumentException("The JWS algorithm must be for a digital signature");
097                }
098                
099                this.jwsAlg = jwsAlg;
100                
101                DefaultJWSSignerFactory factory = new DefaultJWSSignerFactory();
102                if (jcaProvider != null) {
103                        factory.getJCAContext().setProvider(jcaProvider);
104                }
105                jwsSigner = factory.createJWSSigner(jwk, jwsAlg);
106                
107                publicJWK = jwk.toPublicJWK();
108        }
109        
110        
111        /**
112         * Returns the configured public signing JWK.
113         *
114         * @return The public signing JWK.
115         */
116        public JWK getPublicJWK() {
117                return publicJWK;
118        }
119        
120        
121        /**
122         * Returns the configured JWS algorithm.
123         *
124         * @return The JWS algorithm.
125         */
126        public JWSAlgorithm getJWSAlgorithm() {
127                return jwsAlg;
128        }
129        
130        
131        /**
132         * Returns the JWS signer.
133         *
134         * @return The JWS signer.
135         */
136        public JWSSigner getJWSSigner() {
137                return jwsSigner;
138        }
139        
140        
141        @Override
142        public SignedJWT createDPoPJWT(final String htm,
143                                       final URI htu)
144                throws JOSEException {
145                
146                return createDPoPJWT(htm, htu, null, null);
147        }
148        
149        
150        @Override
151        public SignedJWT createDPoPJWT(final String htm,
152                                       final URI htu,
153                                       final Nonce nonce)
154                throws JOSEException {
155                
156                return createDPoPJWT(htm, htu, null, nonce);
157        }
158        
159        
160        @Override
161        public SignedJWT createDPoPJWT(final String htm,
162                                       final URI htu,
163                                       final AccessToken accessToken)
164                throws JOSEException {
165                
166                return createDPoPJWT(htm, htu, accessToken, null);
167        }
168        
169        
170        @Override
171        public SignedJWT createDPoPJWT(final String htm,
172                                       final URI htu,
173                                       final AccessToken accessToken,
174                                       final Nonce nonce)
175                throws JOSEException {
176                
177                return createDPoPJWT(new JWTID(MINIMAL_JTI_BYTE_LENGTH), htm, htu, new Date(), accessToken, nonce);
178        }
179        
180        
181        @Override
182        public SignedJWT createDPoPJWT(final JWTID jti,
183                                       final String htm,
184                                       final URI htu,
185                                       final Date iat,
186                                       final AccessToken accessToken)
187                throws JOSEException {
188                
189                return createDPoPJWT(jti, htm, htu, iat, accessToken, null);
190        }
191        
192        
193        @Override
194        public SignedJWT createDPoPJWT(final JWTID jti,
195                                       final String htm,
196                                       final URI htu,
197                                       final Date iat,
198                                       final AccessToken accessToken,
199                                       final Nonce nonce)
200                throws JOSEException {
201                
202                JWSHeader jwsHeader = new JWSHeader.Builder(getJWSAlgorithm())
203                        .type(TYPE)
204                        .jwk(getPublicJWK())
205                        .build();
206                
207                JWTClaimsSet jwtClaimsSet = DPoPUtils.createJWTClaimsSet(jti, htm, htu, iat, accessToken, nonce);
208                SignedJWT signedJWT = new SignedJWT(jwsHeader, jwtClaimsSet);
209                signedJWT.sign(getJWSSigner());
210                return signedJWT;
211        }
212}