JwtHeaders.java

  1. /*
  2.  * GovWay - A customizable API Gateway 
  3.  * https://govway.org
  4.  * 
  5.  * Copyright (c) 2005-2025 Link.it srl (https://link.it). 
  6.  * 
  7.  * This program is free software: you can redistribute it and/or modify
  8.  * it under the terms of the GNU General Public License version 3, as published by
  9.  * the Free Software Foundation.
  10.  *
  11.  * This program is distributed in the hope that it will be useful,
  12.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14.  * GNU General Public License for more details.
  15.  *
  16.  * You should have received a copy of the GNU General Public License
  17.  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18.  *
  19.  */

  21. package org.openspcoop2.utils.security;

  23. import java.net.URI;
  24. import java.security.cert.X509Certificate;
  25. import java.util.ArrayList;
  26. import java.util.HashMap;
  27. import java.util.Iterator;
  28. import java.util.List;

  30. import org.apache.cxf.common.util.Base64UrlUtility;
  31. import org.apache.cxf.rs.security.jose.common.KeyManagementUtils;
  32. import org.apache.cxf.rs.security.jose.jwk.JsonWebKey;
  33. import org.apache.cxf.rs.security.jose.jwk.JsonWebKeys;
  34. import org.apache.cxf.rs.security.jose.jwk.JwkUtils;
  35. import org.apache.cxf.rt.security.crypto.MessageDigestUtils;
  36. import org.openspcoop2.utils.UtilsException;

  38. /** 
  39.  * JwtHeaders
  40.  *
  41.  * @author Poli Andrea (apoli@link.it)
  42.  * @author $Author$
  43.  * @version $Rev$, $Date$
  44.  */
  45. public class JwtHeaders {

  47.     public static final String JWT_HDR_ALG = "alg"; // (Algorithm) Header Parameter
  48.     public static final String JWT_HDR_JKU = "jku"; //  (JWK Set URL) Header Parameter
  49.     public static final String JWT_HDR_JWK = "jwk"; // (JSON Web Key) Header Parameter
  50.     public static final String JWT_HDR_KID = "kid"; // (Key ID) Header Parameter
  51.     public static final String JWT_HDR_X5U = "x5u"; // (X.509 URL) Header Parameter
  52.     public static final String JWT_HDR_X5C = "x5c"; // (X.509 Certificate Chain) Header Parameter
  53.     public static final String JWT_HDR_X5T = "x5t"; // (X.509 Certificate SHA-1 Thumbprint) Header Parameter
  54.     public static final String JWT_HDR_X5t_S256 = "x5t#S256"; // (X.509 Certificate SHA-256 Thumbprint) Header Parameter
  55.     public static final String JWT_HDR_TYP = "typ"; // (Type) Header Parameter
  56.     public static final String JWT_HDR_CTY = "cty"; // (Content Type) Header Parameter
  57.     public static final String JWT_HDR_CRIT = "crit"; // (Critical) Header Parameter
  58.     public static final String JWT_HDR_ENC = "enc"; // (Encryption Algorithm) Header Parameter [solo in jwe]
  59.     public static final String JWT_HDR_ZIP = "zip"; // (Compression Algorithm) Header Parameter [solo in jwe]
  60.      
  61.     private String type;
  62.     private String contentType;
  63.     private String kid; 
  64.     private List<String> criticalHeaders = new ArrayList<>();
  65.     private URI x509Url;
  66.     private List<X509Certificate> x509c = new ArrayList<>(); // i certificati servono anche per sha1 e sha256, il field addX5C serve quindi per capire se poi far uscire anche X5C
  67.     private boolean addX5C = false;
  68.     boolean x509IncludeCertSha1 = false;
  69.     boolean x509IncludeCertSha256 = false;
  70.     private URI jwkUrl;
  71.     private JsonWebKey jwKey;
  72.     private HashMap<String, String> extensions = new HashMap<>();
  73.     
  74.     public void setType(String type) {
  75.         this.type = type;
  76.     }
  77.     public void setContentType(String contentType) {
  78.         this.contentType = contentType;
  79.     }
  80.     public String getKid() {
  81.         return this.kid;
  82.     }
  83.     public void addCriticalHeader(String hdr) {
  84.         this.criticalHeaders.add(hdr);
  85.     }
  86.     public void setX509Url(URI x509Url) {
  87.         this.x509Url = x509Url;
  88.     }
  89.     public void addX509cert(X509Certificate x509c) {
  90.         this.x509c.add(x509c);
  91.     }
  92.     public void setAddX5C(boolean addX5C) {
  93.         this.addX5C = addX5C;
  94.     }
  95.     public boolean isX509IncludeCertSha1() {
  96.         return this.x509IncludeCertSha1;
  97.     }
  98.     public boolean isX509IncludeCertSha256() {
  99.         return this.x509IncludeCertSha256;
  100.     }
  101.     public void setJwkUrl(URI jwkUrl) {
  102.         this.jwkUrl = jwkUrl;
  103.     }
  104.     public void setJwKey(JsonWebKey jwKey) {
  105.         this.jwKey = jwKey;
  106.     }
  107.     public void setJwKey(JsonWebKeys jsonWebKeys, String alias) throws UtilsException {
  108.         this.jwKey = JsonUtils.readKey(jsonWebKeys, alias);
  109.     }
  110.     public void addExtension(String hdr, String value) {
  111.         this.extensions.put(hdr, value);
  112.     }
  113.     
  114.     public String getType() {
  115.         return this.type;
  116.     }
  117.     public String getContentType() {
  118.         return this.contentType;
  119.     }
  120.     public void setKid(String kid) {
  121.         this.kid = kid;
  122.     }
  123.     public List<String> getCriticalHeaders() {
  124.         return this.criticalHeaders;
  125.     }
  126.     public URI getX509Url() {
  127.         return this.x509Url;
  128.     }
  129.     public boolean isAddX5C() {
  130.         return this.addX5C;
  131.     }
  132.     public List<X509Certificate> getX509c() {
  133.         return this.x509c;
  134.     }
  135.     public void setX509IncludeCertSha1(boolean includeCertSha1) {
  136.         this.x509IncludeCertSha1 = includeCertSha1;
  137.     }
  138.     public void setX509IncludeCertSha256(boolean includeCertSha256) {
  139.         this.x509IncludeCertSha256 = includeCertSha256;
  140.     }
  141.     public URI getJwkUrl() {
  142.         return this.jwkUrl;
  143.     }
  144.     public JsonWebKey getJwKey() {
  145.         return this.jwKey;
  146.     }
  147.     public HashMap<String, String> getExtensions() {
  148.         return this.extensions;
  149.     }
  150.     
  151.     public List<String> headers(){
  152.         List<String> list = new ArrayList<>();
  153.         if(this.type!=null) {
  154.             list.add(JWT_HDR_TYP);
  155.         }
  156.         if(this.contentType!=null) {
  157.             list.add(JWT_HDR_CTY);
  158.         }
  159.         if(this.kid!=null) {
  160.             list.add(JWT_HDR_KID);
  161.         }
  162.         if(this.criticalHeaders!=null && !this.criticalHeaders.isEmpty()) {
  163.             list.add(JWT_HDR_CRIT);
  164.         }
  165.         if(this.x509Url!=null) {
  166.             list.add(JWT_HDR_X5U);
  167.         }
  168.         if(this.x509c!=null && !this.x509c.isEmpty()) {
  169.             // fix: lo aggiungo solo se non c'è la url. Nell'oggetto JwtHreader il certificato ho dovuto mettercelo per creare i sha
  170.             //if(!list.contains(JWT_HDR_X5U)) {
  171.             // il fix era errato, aggiunto field apposito 'addX5C'
  172.             if(this.addX5C) {
  173.                 list.add(JWT_HDR_X5C);
  174.             }
  175.         }
  176.         if(this.x509IncludeCertSha1 && this.x509c!=null && !this.x509c.isEmpty()) {
  177.             list.add(JWT_HDR_X5T);
  178.         }
  179.         if(this.x509IncludeCertSha256) {
  180.             list.add(JWT_HDR_X5t_S256);
  181.         }
  182.         if(this.jwkUrl!=null) {
  183.             list.add(JWT_HDR_JKU);
  184.         }
  185.         if(this.jwKey!=null) {
  186.             list.add(JWT_HDR_JWK);
  187.         }
  188.         if(this.extensions!=null && !this.extensions.isEmpty()) {
  189.             Iterator<String> hdrIt = this.extensions.keySet().iterator();
  190.             while (hdrIt.hasNext()) {
  191.                 String hdr = (String) hdrIt.next();
  192.                 list.add(hdr);
  193.             }
  194.         }
  195.         return list;
  196.     }
  197.     
  198.     public void fillJwsHeaders(org.apache.cxf.rs.security.jose.common.JoseHeaders hdrs, boolean forceOverride, String algorithm) throws Exception {
  199.         if(this.type!=null) {
  200.             if(!hdrs.containsHeader(JWT_HDR_TYP) || forceOverride) {
  201.                 hdrs.setHeader(JWT_HDR_TYP, this.type);
  202.             }
  203.         }
  204.         if(this.contentType!=null) {
  205.             if(!hdrs.containsHeader(JWT_HDR_CTY) || forceOverride) {
  206.                 hdrs.setContentType(this.contentType);
  207.             }
  208.         }
  209.         if(this.kid!=null) {
  210.             if(!hdrs.containsHeader(JWT_HDR_KID) || forceOverride) {
  211.                 hdrs.setKeyId(this.kid);
  212.             }
  213.         }
  214.         if(this.criticalHeaders!=null && !this.criticalHeaders.isEmpty()) {
  215.             List<String> headers = new ArrayList<>();
  216.             if(hdrs.containsHeader(JWT_HDR_CRIT)) {
  217.                 headers = hdrs.getCritical();
  218.                 if(headers==null) {
  219.                     headers = new ArrayList<>();
  220.                 }
  221.             }
  222.             for (String ch : this.criticalHeaders) {
  223.                 if(headers.contains(ch)==false) {
  224.                     headers.add(ch);
  225.                 }
  226.             }
  227.             /*
  228.             StringBuilder bf = new StringBuilder();
  229.             for (String ch : headers) {
  230.                 if(bf.length()>0) {
  231.                     bf.append(",");
  232.                 }
  233.                 bf.append("\"").append(ch).append("\"");
  234.             }
  235.             hdrs.setHeader(JWT_HDR_CRIT, "["+bf.toString()+"]");*/
  236.             hdrs.setCritical(headers);
  237.         }
  238.         if(this.x509Url!=null) {
  239.             if(!hdrs.containsHeader(JWT_HDR_X5U) || forceOverride) {
  240.                 hdrs.setX509Url(this.x509Url.toString());
  241.             }
  242.         }
  243.         if(this.x509c!=null && !this.x509c.isEmpty()) {
  244.             if(!hdrs.containsHeader(JWT_HDR_X5C) || forceOverride) {
  245.                 // fix: lo aggiungo solo se non c'è la url. Nell'oggetto JwtHreader il certificato ho dovuto mettercelo per creare i sha
  246.                 //if(!hdrs.containsHeader(JWT_HDR_X5U)) {
  247.                 // il fix era errato, aggiunto field apposito 'addX5C'
  248.                 if(this.addX5C) {
  249.                     X509Certificate[] chain = this.x509c.toArray(new X509Certificate[1]);
  250.                     hdrs.setX509Chain(KeyManagementUtils.encodeX509CertificateChain(chain));
  251.                 }
  252.             }
  253.         }
  254.         if(this.x509IncludeCertSha1 && this.x509c!=null && !this.x509c.isEmpty()) {
  255.             if(!hdrs.containsHeader(JWT_HDR_X5T) || forceOverride) {
  256.                 X509Certificate[] chain = this.x509c.toArray(new X509Certificate[1]);
  257.                 byte[] digestB = MessageDigestUtils.createDigest(chain[0].getEncoded(), MessageDigestUtils.ALGO_SHA_1);
  258.                 String digest = Base64UrlUtility.encode(digestB);
  259.                 hdrs.setX509Thumbprint(digest);
  260.             }
  261.         }
  262.         if(this.x509IncludeCertSha256) {
  263.             if(!hdrs.containsHeader(JWT_HDR_X5t_S256) || forceOverride) {
  264.                 X509Certificate[] chain = this.x509c.toArray(new X509Certificate[1]);
  265.                 byte[] digestB = MessageDigestUtils.createDigest(chain[0].getEncoded(), MessageDigestUtils.ALGO_SHA_256);
  266.                 String digest = Base64UrlUtility.encode(digestB);
  267.                 hdrs.setX509ThumbprintSHA256(digest);
  268.             }
  269.         }
  270.         if(this.jwkUrl!=null) {
  271.             if(!hdrs.containsHeader(JWT_HDR_JKU) || forceOverride) {
  272.                 hdrs.setJsonWebKeysUrl(this.jwkUrl.toString());
  273.             }
  274.         }
  275.         if(this.jwKey!=null) {
  276.             if(!hdrs.containsHeader(JWT_HDR_JWK) || forceOverride) {
  277.                 JwkUtils.includeCertChain(this.jwKey, hdrs, algorithm);
  278.                 JwkUtils.includePublicKey(this.jwKey, hdrs, algorithm);
  279.             }
  280.         }
  281.         if(this.extensions!=null && !this.extensions.isEmpty()) {
  282.             Iterator<String> hdrIt = this.extensions.keySet().iterator();
  283.             while (hdrIt.hasNext()) {
  284.                 String hdr = (String) hdrIt.next();
  285.                 if(!hdrs.containsHeader(hdr) || forceOverride) {
  286.                     String value = this.extensions.get(hdr);
  287.                     hdrs.setHeader(hdr,value);
  288.                 }
  289.             }
  290.         }
  291.     }
  292.     
  293. }
Created with JaCoCo 0.8.8.202204050719