001/*
002* The contents of this file are subject to the terms of the Common Development and
003* Distribution License (the License). You may not use this file except in compliance with the
004* License.
005*
006* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
007* specific language governing permission and limitations under the License.
008*
009* When distributing Covered Software, include this CDDL Header Notice in each file and include
010* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
011* Header, with the fields enclosed by brackets [] replaced by your own identifying
012* information: "Portions copyright [year] [name of copyright owner]".
013*
014* Copyright 2014 ForgeRock AS.
015*/
016package org.forgerock.jaspi.modules.openid.resolvers;
017
018import org.forgerock.jaspi.modules.openid.exceptions.OpenIdConnectVerificationException;
019import org.forgerock.json.jose.jws.SignedJwt;
020
021/**
022 * Validation of Open ID Connect JWTs via verification of their internals
023 * (issuer, audience, signature, etc.). Each Resolver relates to one
024 * specific issuer (which can be retrieved via
025 * {@link org.forgerock.jaspi.modules.openid.resolvers.OpenIdResolver#getIssuer()}) and
026 * performs validation against a supplied {@link SignedJwt}, throwing an
027 * {@link OpenIdConnectVerificationException} if there are any issues which do not
028 * conform to the verification spec as per:
029 *
030 * More details on how the verification should be completed can be found at
031 * <a href="http://openid.net/specs/openid-authentication-2_0.html">
032 *     http://openid.net/specs/openid-authentication-2_0.html</a>
033 *
034 * {@link OpenIdResolver#validateIdentity(org.forgerock.json.jose.jws.SignedJwt)} performs all individual checks.
035 */
036public interface OpenIdResolver {
037
038    /**
039     * Lookup key for a key stored in a keystore.
040     */
041    public static final String KEY_ALIAS_KEY = "keyAlias";
042
043    /**
044     * Lookup key for the issuer's name.
045     */
046    public static final String ISSUER_KEY = "issuer";
047
048    /**
049     * Lookup key for the client secret.
050     */
051    public static final String CLIENT_SECRET_KEY = "clientSecret";
052
053    /**
054     * Lookup key for JWK configuration.
055     */
056    public static final String JWK = "jwk";
057
058    /**
059     * Lookup key for a .well-known Open ID Connect config.
060     */
061    public static final String WELL_KNOWN_CONFIGURATION = "well-known";
062
063    /**
064     * Lookup key for the location of a keystore.
065     */
066    public static final String KEYSTORE_LOCATION_KEY = "keystoreLocation";
067
068    /**
069     * Lookup key for the type of a keystore.
070     */
071    public static final String KEYSTORE_TYPE_KEY = "keystoreType";
072
073    /**
074     * Lookup key for the password to a keystore.
075     */
076    public static final String KEYSTORE_PASS_KEY = "keystorePassword";
077
078    /**
079     * Validates the supplied Jwt against this OpenId Connect Idp.
080     *
081     * @param idClaim The Jwt to test is authenticated from this issuer
082     * @throws OpenIdConnectVerificationException If the Jwt is unable to be verified
083     */
084    public void validateIdentity(final SignedJwt idClaim) throws OpenIdConnectVerificationException;
085
086    /**
087     * Returns the issuer (IdP) for which this resolver will resolve identities.
088     *
089     * @return the name of the issuer
090     */
091    public String getIssuer();
092}