Modifier and Type	Class and Description
public static class	TokenVerifier.AudienceCheck
public static class	TokenVerifier.IssuedForCheck
public static interface	TokenVerifier.Predicate< Type of the token handled by this predicate. T extends JsonWebToken> Functional interface of checks that verify some part of a JWT.
public static class	TokenVerifier.RealmUrlCheck
public static class	TokenVerifier.TokenTypeCheck

Modifier and Type	Field and Description
private boolean	checkRealmUrl
private final LinkedList<TokenVerifier.Predicate<? super T>>	checks
private boolean	checkTokenType
private Class<? extends T>	clazz
private List<String>	expectedTokenType
public static final TokenVerifier.Predicate<JsonWebToken>	IS_ACTIVE Check for token being neither expired nor used before it gets valid.
private JWSInput	jws
private static final Logger	LOG
private PublicKey	publicKey
private String	realmUrl
private SecretKey	secretKey
public static final TokenVerifier.Predicate<JsonWebToken>	SUBJECT_EXISTS_CHECK
private T	token
private String	tokenString
private SignatureVerifierContext	verifier

Access	Constructor and Description
protected	TokenVerifier(String tokenString, Class<T> clazz)
protected	TokenVerifier(T token)

Method Summary

Modifier and Type	Method and Description
public static <T extends JsonWebToken> TokenVerifier.Predicate<T>	alternative(final TokenVerifier.Predicate<? super T>... predicates) Creates a predicate that will proceed with checks of the given predicates and will pass if and only if at least one of the given predicates passes.
public TokenVerifier<T>	Returns: This token verifier audience(String... Audiences, which needs to be in the target token. Can be `null`. expectedAudiences) Add check for verifying that token contains the expectedAudience
public TokenVerifier<T>	Returns: This token verifier checkActive(boolean checkActive) Deprecated This method is here only for backward compatibility with previous version of `TokenVerifier`.
public TokenVerifier<T>	Returns: This token verifier checkRealmUrl(boolean checkRealmUrl) Deprecated This method is here only for backward compatibility with previous version of `TokenVerifier`.
public TokenVerifier<T>	Returns: This token verifier checkTokenType(boolean checkTokenType) Deprecated This method is here only for backward compatibility with previous version of `TokenVerifier`.
public static < Type of the token T extends JsonWebToken> TokenVerifier<T>	create(String String representation of JWT tokenString, Class<T> Class of the token clazz) Creates an instance of `TokenVerifier` from the given string on a JWT of the given class.
public static <T extends JsonWebToken> TokenVerifier<T>	createWithoutSignature(T token) Creates an instance of `TokenVerifier` for the given token.
public JWSHeader	getHeader()
public T	getToken()
public TokenVerifier<T>	Returns: This token verifier issuedFor(String issuedFor, which needs to be in the target token. Can't be null expectedIssuedFor) Add check for verifying that token issuedFor (azp claim) is the expected value
public static <T extends JsonWebToken> TokenVerifier.Predicate<T>	optional(final TokenVerifier.Predicate<T> mandatoryPredicate) Creates an optional predicate from a predicate that will proceed with check but always pass.
public TokenVerifier<T>	parse()
public TokenVerifier<T>	publicKey(PublicKey publicKey) Sets the key for verification of RSA-based signature.
public TokenVerifier<T>	Returns: This token verifier realmUrl(String realmUrl) Deprecated This method is here only for backward compatibility with previous version of `TokenVerifier`.
private void	removeCheck(Class<? extends TokenVerifier.Predicate<?>> checkClass)
private void	removeCheck(TokenVerifier.Predicate<? super T> check)
private <P extends TokenVerifier.Predicate<? super T>> TokenVerifier<T>	replaceCheck(Class<? extends TokenVerifier.Predicate<?>> checkClass, boolean active, P... predicate)
private <P extends TokenVerifier.Predicate<? super T>> TokenVerifier<T>	replaceCheck(TokenVerifier.Predicate<? super T> check, boolean active, P... predicate)
public TokenVerifier<T>	secretKey(SecretKey secretKey) Sets the key for verification of HMAC-based signature.
public TokenVerifier<T>	Returns: This token verifier tokenType(List<String> tokenTypes)
public TokenVerifier<T>	verifierContext(SignatureVerifierContext verifier)
public TokenVerifier<T>	verify()
public void	verifySignature()
public final TokenVerifier<T>	withChecks(TokenVerifier.Predicate<? super T>... checks) Will test the given checks in `verify()` method in addition to already set checks.
public TokenVerifier<T>	Returns: This token verifier. withDefaultChecks() Adds default checks to the token verification: Realm URL (JWT issuer field: `iss`) has to be defined and match realm set via `realmUrl(java.lang.String)` method Subject (JWT subject field: `sub`) has to be defined Token type (JWT type field: `typ`) has to be `Bearer`. The type can be set via `tokenType(java.lang.String)` method Token has to be active, ie. both not expired and not used before its validity (JWT issuer fields: `exp` and `nbf`)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

checkRealmUrl	back to summary
private boolean checkRealmUrl

checks	back to summary
private final LinkedList<TokenVerifier.Predicate<? super T>> checks

checkTokenType	back to summary
private boolean checkTokenType

clazz	back to summary
private Class<? extends T> clazz

expectedTokenType	back to summary
private List<String> expectedTokenType

IS_ACTIVE back to summary

IS_ACTIVE	back to summary
public static final TokenVerifier.Predicate<JsonWebToken> IS_ACTIVE Check for token being neither expired nor used before it gets valid. See Also `JsonWebToken#isActive()`

public static final TokenVerifier.Predicate<JsonWebToken> IS_ACTIVE

Check for token being neither expired nor used before it gets valid.

See Also: JsonWebToken#isActive()

jws	back to summary
private JWSInput jws

LOG	back to summary
private static final Logger LOG

publicKey	back to summary
private PublicKey publicKey

realmUrl	back to summary
private String realmUrl

secretKey	back to summary
private SecretKey secretKey

SUBJECT_EXISTS_CHECK	back to summary
public static final TokenVerifier.Predicate<JsonWebToken> SUBJECT_EXISTS_CHECK

token	back to summary
private T token

tokenString	back to summary
private String tokenString

verifier	back to summary
private SignatureVerifierContext verifier

Constructor Detail

TokenVerifier	back to summary
protected TokenVerifier(String tokenString, Class<T> clazz)

TokenVerifier	back to summary
protected TokenVerifier(T token)

Method Detail

alternative	back to summary
public static <T extends JsonWebToken> TokenVerifier.Predicate<T> alternative(final TokenVerifier.Predicate<? super T>... predicates) Creates a predicate that will proceed with checks of the given predicates and will pass if and only if at least one of the given predicates passes. Annotations @SafeVarargs

alternative

back to summary

public static <T extends JsonWebToken> TokenVerifier.Predicate<T> alternative(final TokenVerifier.Predicate<? super T>... predicates)

Creates a predicate that will proceed with checks of the given predicates and will pass if and only if at least one of the given predicates passes.

Annotations

@SafeVarargs

audience back to summary

audience	back to summary
public TokenVerifier<T> audience(String... expectedAudiences) Add check for verifying that token contains the expectedAudience Parameters expectedAudiences:String[] Audiences, which needs to be in the target token. Can be `null`. Returns:TokenVerifier<T> This token verifier

public TokenVerifier<T> audience(String... expectedAudiences)

Add check for verifying that token contains the expectedAudience

Parameters

expectedAudiences:String[]: Audiences, which needs to be in the target token. Can be null.

Returns:TokenVerifier<T>

This token verifier

checkActive	back to summary
public TokenVerifier<T> checkActive(boolean checkActive) Deprecated This method is here only for backward compatibility with previous version of `TokenVerifier`. Returns:TokenVerifier<T> This token verifier

checkRealmUrl	back to summary
public TokenVerifier<T> checkRealmUrl(boolean checkRealmUrl) Deprecated This method is here only for backward compatibility with previous version of `TokenVerifier`. Returns:TokenVerifier<T> This token verifier

checkTokenType	back to summary
public TokenVerifier<T> checkTokenType(boolean checkTokenType) Deprecated This method is here only for backward compatibility with previous version of `TokenVerifier`. Returns:TokenVerifier<T> This token verifier

create back to summary

create	back to summary
public static <T extends JsonWebToken> TokenVerifier<T> create(String tokenString, Class<T> clazz) Creates an instance of `TokenVerifier` from the given string on a JWT of the given class. The token verifier has no checks defined. Note that the checks are only tested when `verify()` method is invoked. Parameters <T> Type of the token tokenString:String String representation of JWT clazz:Class<T> Class of the token

public static <T extends JsonWebToken> TokenVerifier<T> create(String tokenString, Class<T> clazz)

Creates an instance of TokenVerifier from the given string on a JWT of the given class. The token verifier has no checks defined. Note that the checks are only tested when verify() method is invoked.

Parameters

<T>: Type of the token
tokenString:String: String representation of JWT
clazz:Class<T>: Class of the token

createWithoutSignature	back to summary
public static <T extends JsonWebToken> TokenVerifier<T> createWithoutSignature(T token) Creates an instance of `TokenVerifier` for the given token. The token verifier has no checks defined. Note that the checks are only tested when `verify()` method is invoked. Note The returned token verifier cannot verify token signature since that is not part of the `JsonWebToken` object.

getHeader	back to summary
public JWSHeader getHeader() throws VerificationException

getToken	back to summary
public T getToken() throws VerificationException

issuedFor	back to summary
public TokenVerifier<T> issuedFor(String expectedIssuedFor) Add check for verifying that token issuedFor (azp claim) is the expected value Parameters expectedIssuedFor:String issuedFor, which needs to be in the target token. Can't be null Returns:TokenVerifier<T> This token verifier

issuedFor

back to summary

public TokenVerifier<T> issuedFor(String expectedIssuedFor)

Add check for verifying that token issuedFor (azp claim) is the expected value

Parameters

expectedIssuedFor:String: issuedFor, which needs to be in the target token. Can't be null

Returns:TokenVerifier<T>

This token verifier

optional	back to summary
public static <T extends JsonWebToken> TokenVerifier.Predicate<T> optional(final TokenVerifier.Predicate<T> mandatoryPredicate) Creates an optional predicate from a predicate that will proceed with check but always pass.

parse	back to summary
public TokenVerifier<T> parse() throws VerificationException

publicKey	back to summary
public TokenVerifier<T> publicKey(PublicKey publicKey) Sets the key for verification of RSA-based signature.

realmUrl	back to summary
public TokenVerifier<T> realmUrl(String realmUrl) Deprecated This method is here only for backward compatibility with previous version of `TokenVerifier`. Returns:TokenVerifier<T> This token verifier

removeCheck	back to summary
private void removeCheck(Class<? extends TokenVerifier.Predicate<?>> checkClass)

removeCheck	back to summary
private void removeCheck(TokenVerifier.Predicate<? super T> check)

replaceCheck	back to summary
private <P extends TokenVerifier.Predicate<? super T>> TokenVerifier<T> replaceCheck(Class<? extends TokenVerifier.Predicate<?>> checkClass, boolean active, P... predicate) Annotations @SuppressWarnings:unchecked

replaceCheck	back to summary
private <P extends TokenVerifier.Predicate<? super T>> TokenVerifier<T> replaceCheck(TokenVerifier.Predicate<? super T> check, boolean active, P... predicate) Annotations @SuppressWarnings:unchecked

secretKey	back to summary
public TokenVerifier<T> secretKey(SecretKey secretKey) Sets the key for verification of HMAC-based signature.

tokenType	back to summary
public TokenVerifier<T> tokenType(List<String> tokenTypes) Returns:TokenVerifier<T> This token verifier

verifierContext	back to summary
public TokenVerifier<T> verifierContext(SignatureVerifierContext verifier)

verify	back to summary
public TokenVerifier<T> verify() throws VerificationException

verifySignature	back to summary
public void verifySignature() throws VerificationException

withChecks back to summary

withChecks	back to summary
public final TokenVerifier<T> withChecks(TokenVerifier.Predicate<? super T>... checks) Will test the given checks in `verify()` method in addition to already set checks. Annotations @SafeVarargs

public final TokenVerifier<T> withChecks(TokenVerifier.Predicate<? super T>... checks)

Will test the given checks in verify() method in addition to already set checks.

Annotations

@SafeVarargs

withDefaultChecks back to summary

withDefaultChecks	back to summary
public TokenVerifier<T> withDefaultChecks() Adds default checks to the token verification: Realm URL (JWT issuer field: `iss`) has to be defined and match realm set via `realmUrl(java.lang.String)` method Subject (JWT subject field: `sub`) has to be defined Token type (JWT type field: `typ`) has to be `Bearer`. The type can be set via `tokenType(java.lang.String)` method Token has to be active, ie. both not expired and not used before its validity (JWT issuer fields: `exp` and `nbf`) Returns:TokenVerifier<T> This token verifier.

public TokenVerifier<T> withDefaultChecks()

Adds default checks to the token verification:

Realm URL (JWT issuer field: iss) has to be defined and match realm set via realmUrl(java.lang.String) method
Subject (JWT subject field: sub) has to be defined
Token type (JWT type field: typ) has to be Bearer. The type can be set via tokenType(java.lang.String) method
Token has to be active, ie. both not expired and not used before its validity (JWT issuer fields: exp and nbf)

Returns:TokenVerifier<T>: This token verifier.

org.keycloak back to summary

public Class TokenVerifier.AudienceCheck

Class Inheritance

extends Object
implements TokenVerifier.Predicate<JsonWebToken>

java.lang.Object
org.keycloak.TokenVerifier.AudienceCheck

All Implemented Interfaces

org.keycloak.TokenVerifier.Predicate

Field Summary

Modifier and Type	Field and Description
private final String	expectedAudience

Constructor Summary

Access	Constructor and Description
public	AudienceCheck(String expectedAudience)

Method Summary

Modifier and Type	Method and Description
public boolean	test(JsonWebToken Token, guaranteed to be non-null. t) Implements org.keycloak.TokenVerifier.Predicate.test. Performs a single check on the given token verifier.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

expectedAudience	back to summary
private final String expectedAudience

Constructor Detail

AudienceCheck	back to summary
public AudienceCheck(String expectedAudience)

Method Detail

test

back to summary

public boolean test(JsonWebToken t) throws VerificationException

Implements org.keycloak.TokenVerifier.Predicate.test.

Doc from org.keycloak.TokenVerifier.Predicate.test.

Performs a single check on the given token verifier.

Parameters

t:JsonWebToken: Token, guaranteed to be non-null.

Annotations

@Override

org.keycloak back to summary

public Class TokenVerifier.IssuedForCheck

Class Inheritance

extends Object
implements TokenVerifier.Predicate<JsonWebToken>

java.lang.Object
org.keycloak.TokenVerifier.IssuedForCheck

All Implemented Interfaces

org.keycloak.TokenVerifier.Predicate

Field Summary

Modifier and Type	Field and Description
private final String	expectedIssuedFor

Constructor Summary

Access	Constructor and Description
public	IssuedForCheck(String expectedIssuedFor)

Method Summary

Modifier and Type	Method and Description
public boolean	test(JsonWebToken Token, guaranteed to be non-null. jsonWebToken) Implements org.keycloak.TokenVerifier.Predicate.test. Performs a single check on the given token verifier.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

expectedIssuedFor	back to summary
private final String expectedIssuedFor

Constructor Detail

IssuedForCheck	back to summary
public IssuedForCheck(String expectedIssuedFor)

Method Detail

test

back to summary

public boolean test(JsonWebToken jsonWebToken) throws VerificationException

Implements org.keycloak.TokenVerifier.Predicate.test.

Doc from org.keycloak.TokenVerifier.Predicate.test.

Performs a single check on the given token verifier.

Parameters

jsonWebToken:JsonWebToken: Token, guaranteed to be non-null.

Annotations

@Override

org.keycloak back to summary

public Interface TokenVerifier.Predicate<T extends org.keycloak.representations.JsonWebToken>

Known Direct Implementers

org.keycloak.TokenVerifier.RealmUrlCheck, org.keycloak.TokenVerifier.TokenTypeCheck, org.keycloak.TokenVerifier.AudienceCheck, org.keycloak.TokenVerifier.IssuedForCheck

Type Parameters

<T>: Type of the token handled by this predicate.

Functional interface of checks that verify some part of a JWT.

Method Summary

Modifier and Type	Method and Description
public boolean	test(T Token, guaranteed to be non-null. t) Performs a single check on the given token verifier.

Method Detail

test

back to summary

public boolean test(T t) throws VerificationException

Performs a single check on the given token verifier.

Parameters

t:T: Token, guaranteed to be non-null.

org.keycloak back to summary

public Class TokenVerifier.RealmUrlCheck

Class Inheritance

extends Object
implements TokenVerifier.Predicate<JsonWebToken>

java.lang.Object
org.keycloak.TokenVerifier.RealmUrlCheck

All Implemented Interfaces

org.keycloak.TokenVerifier.Predicate

Field Summary

Modifier and Type	Field and Description
private static final TokenVerifier.RealmUrlCheck	NULL_INSTANCE
private final String	realmUrl

Constructor Summary

Access	Constructor and Description
public	RealmUrlCheck(String realmUrl)

Method Summary

Modifier and Type	Method and Description
public boolean	test(JsonWebToken Token, guaranteed to be non-null. t) Implements org.keycloak.TokenVerifier.Predicate.test. Performs a single check on the given token verifier.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

NULL_INSTANCE	back to summary
private static final TokenVerifier.RealmUrlCheck NULL_INSTANCE

realmUrl	back to summary
private final String realmUrl

Constructor Detail

RealmUrlCheck	back to summary
public RealmUrlCheck(String realmUrl)

Method Detail

test

back to summary

public boolean test(JsonWebToken t) throws VerificationException

Implements org.keycloak.TokenVerifier.Predicate.test.

Doc from org.keycloak.TokenVerifier.Predicate.test.

Performs a single check on the given token verifier.

Parameters

t:JsonWebToken: Token, guaranteed to be non-null.

Annotations

@Override

org.keycloak back to summary

public Class TokenVerifier.TokenTypeCheck

Class Inheritance

extends Object
implements TokenVerifier.Predicate<JsonWebToken>

java.lang.Object
org.keycloak.TokenVerifier.TokenTypeCheck

All Implemented Interfaces

org.keycloak.TokenVerifier.Predicate

Field Summary

Modifier and Type	Field and Description
private static final TokenVerifier.TokenTypeCheck	INSTANCE_DEFAULT_TOKEN_TYPE
private final List<String>	tokenTypes

Constructor Summary

Access	Constructor and Description
public	TokenTypeCheck(List<String> tokenTypes)

Method Summary

Modifier and Type	Method and Description
public boolean	test(JsonWebToken Token, guaranteed to be non-null. t) Implements org.keycloak.TokenVerifier.Predicate.test. Performs a single check on the given token verifier.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

INSTANCE_DEFAULT_TOKEN_TYPE	back to summary
private static final TokenVerifier.TokenTypeCheck INSTANCE_DEFAULT_TOKEN_TYPE

tokenTypes	back to summary
private final List<String> tokenTypes

Constructor Detail

TokenTypeCheck	back to summary
public TokenTypeCheck(List<String> tokenTypes)

Method Detail

test

back to summary

public boolean test(JsonWebToken t) throws VerificationException

Implements org.keycloak.TokenVerifier.Predicate.test.

Doc from org.keycloak.TokenVerifier.Predicate.test.

Performs a single check on the given token verifier.

Parameters

t:JsonWebToken: Token, guaranteed to be non-null.

Annotations

@Override

public Class TokenVerifier<T extends org.keycloak.representations.JsonWebToken>

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Class TokenVerifier.AudienceCheck

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Class TokenVerifier.IssuedForCheck

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Interface TokenVerifier.Predicate<T extends org.keycloak.representations.JsonWebToken>

Method Summary

Method Detail

public Class TokenVerifier.RealmUrlCheck

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Class TokenVerifier.TokenTypeCheck

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail