Package org.apache.kafka.common.security.oauthbearer

Class ClientJwtValidator

java.lang.Object

org.apache.kafka.common.security.oauthbearer.ClientJwtValidator

All Implemented Interfaces:

Closeable, AutoCloseable, org.apache.kafka.common.security.oauthbearer.internals.secured.OAuthBearerConfigurable, JwtValidator

public class ClientJwtValidator
extends Object
implements JwtValidator

ClientJwtValidator is an implementation of JwtValidator that is used by the client to perform some rudimentary validation of the JWT access token that is received as part of the response from posting the client credentials to the OAuth/OIDC provider's token endpoint. The validation steps performed are:

1. Basic structural validation of the b64token value as defined in RFC 6750 Section 2.1
2. Basic conversion of the token into an in-memory map
3. Presence of scope, exp, subject, and iat claims

Field Summary

Fields

Modifier and Type	Field	Description
static final String	EXPIRATION_CLAIM_NAME
static final String	ISSUED_AT_CLAIM_NAME

Constructor Summary

Constructors

Constructor	Description
ClientJwtValidator()

Method Summary

Modifier and Type	Method	Description
void	configure(Map<String,?> configs, String saslMechanism, List<AppConfigurationEntry> jaasConfigEntries)
OAuthBearerToken	validate(String accessToken)	Accepts an OAuth JWT access token in base-64 encoded format, validates, and returns an OAuthBearerToken.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.kafka.common.security.oauthbearer.internals.secured.OAuthBearerConfigurable

close

Field Details

EXPIRATION_CLAIM_NAME

public static final String EXPIRATION_CLAIM_NAME

See Also:

• Constant Field Values

ISSUED_AT_CLAIM_NAME

public static final String ISSUED_AT_CLAIM_NAME

See Also:

• Constant Field Values

Constructor Details

ClientJwtValidator

public ClientJwtValidator()

Method Details

configure

public void configure(Map<String,?> configs,
 String saslMechanism,
 List<AppConfigurationEntry> jaasConfigEntries)

Specified by:

configure in interface org.apache.kafka.common.security.oauthbearer.internals.secured.OAuthBearerConfigurable

validate

public OAuthBearerToken validate(String accessToken)
                          throws JwtValidatorException

Accepts an OAuth JWT access token in base-64 encoded format, validates, and returns an OAuthBearerToken.

Specified by:

validate in interface JwtValidator

Parameters:

accessToken - Non-null JWT access token

Returns:

OAuthBearerToken

Throws:

JwtValidatorException - Thrown on errors performing validation of given token