import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
@Test
public void rsaKeyCreatesValidRsaSignedTokens() throws Exception {
	String rsaKey = "-----BEGIN RSA PRIVATE KEY-----  \n"
			+ "MIIBywIBAAJhAOTeb4AZ+NwOtPh+ynIgGqa6UWNVe6JyJi+loPmPZdpHtzoqubnC \n"
			+ "wEs6JSiSZ3rButEAw8ymgLV6iBY02hdjsl3h5Z0NWaxx8dzMZfXe4EpfB04ISoqq\n"
			+ "hZCxchvuSDP4eQIDAQABAmEAqUuYsuuDWFRQrZgsbGsvC7G6zn3HLIy/jnM4NiJK\n"
			+ "t0JhWNeN9skGsR7bqb1Sak2uWqW8ZqnqgAC32gxFRYHTavJEk6LTaHWovwDEhPqc\n"
			+ "Zs+vXd6tZojJQ35chR/slUEBAjEA/sAd1oFLWb6PHkaz7r2NllwUBTvXL4VcMWTS\n"
			+ "pN+5cU41i9fsZcHw6yZEl+ZCicDxAjEA5f3R+Bj42htNI7eylebew1+sUnFv1xT8\n"
			+ "jlzxSzwVkoZo+vef7OD6OcFLeInAHzAJAjEAs6izolK+3ETa1CRSwz0lPHQlnmdM\n"
			+ "Y/QuR5tuPt6U/saEVuJpkn4LNRtg5qt6I4JRAjAgFRYTG7irBB/wmZFp47izXEc3\n"
			+ "gOdvA1hvq3tlWU5REDrYt24xpviA0fvrJpwMPbECMAKDKdiDi6Q4/iBkkzNMefA8\n"
			+ "7HX27b9LR33don/1u/yvzMUo+lrRdKAFJ+9GPE9XFA== \n" + "-----END RSA PRIVATE KEY----- ";
	tokenEnhancer.setSigningKey(rsaKey);
	OAuth2Authentication authentication = new OAuth2Authentication(createOAuth2Request("foo", null),
			userAuthentication);
	OAuth2AccessToken token = tokenEnhancer.enhance(new DefaultOAuth2AccessToken("FOO"), authentication);
	JwtHelper.decodeAndVerify(token.getValue(), new RsaVerifier(rsaKey));
}
 

import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
@Override
public SignatureVerifier getSignatureVerifier() throws Exception {
    String publicKeyEndpointUri = getTokenEndpoint().replace("/token", "/certs");
    HttpEntity<Void> request = new HttpEntity<Void>(new HttpHeaders());
    LinkedHashMap<String, List<Map<String, Object>>> result =
        restTemplate.getForObject(publicKeyEndpointUri, LinkedHashMap.class);
    Map<String, Object> properties = result.get("keys").get(0);
    BigInteger modulus = new BigInteger(1, Base64Utils.decodeFromUrlSafeString((String) properties.get("n")));
    BigInteger publicExponent = new BigInteger(1, Base64Utils.decodeFromString((String) properties.get("e")));
    try {
        PublicKey publicKey =
            KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(modulus, publicExponent));
        RSAPublicKey rsaKey = (RSAPublicKey) RSAKeyFactory.toRSAKey(publicKey);
        return new RsaVerifier(rsaKey);
    } catch (GeneralSecurityException ex) {
        log.error("could not create key verifier", ex);
        throw ex;
    }
}
 

import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
private static void verifySignature(Jwt jwt, String publicKey) {
    try {
        RsaVerifier rsaVerifier = new RsaVerifier(publicKey);
        jwt.verifySignature(rsaVerifier);
    } catch (Exception ex) {
        throw new AuthenticationServiceException("Error verifying signature of token");
    }
}
 

import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
private OAuth2Authentication getSSOAuthentication(String accessToken) {
    try {
        SignatureVerifier verifier = isAssymetricKey(jwtSignKey) ? new RsaVerifier(jwtSignKey) : new MacSigner(jwtSignKey);
        Jwt jwt = JwtHelper.decodeAndVerify(accessToken, verifier);
        Map<String, Object> claims = objectMapper.readValue(jwt.getClaims(), new MapTypeReference());
        Object userClaim = claims.get("user");
        Map<String, Object> tokenMap = new HashMap<>();
        Map<String, Object> userMap = objectMapper.readValue(userClaim.toString(), new MapTypeReference());
        String exp = claims.get("exp").toString();
        tokenMap.put("exp", Long.valueOf(exp));
        Object email = userMap.get("email");
        tokenMap.put("user_id", email);
        tokenMap.put("user_name", email);
        tokenMap.put("scope", Arrays.asList("cloudbreak.networks.read", "periscope.cluster", "cloudbreak.usages.user", "cloudbreak.recipes", "openid",
            "cloudbreak.templates.read", "cloudbreak.usages.account", "cloudbreak.events", "cloudbreak.stacks.read",
            "cloudbreak.blueprints", "cloudbreak.networks", "cloudbreak.templates", "cloudbreak.credentials.read",
            "cloudbreak.securitygroups.read", "cloudbreak.securitygroups", "cloudbreak.stacks", "cloudbreak.credentials",
            "cloudbreak.recipes.read", "cloudbreak.blueprints.read"));

        OAuth2AccessToken oAuth2AccessToken = jwtAccessTokenConverter.extractAccessToken(accessToken, tokenMap);
        if (oAuth2AccessToken.isExpired()) {
            throw new InvalidTokenException("The token has expired");
        }
        OAuth2Authentication oAuth2Authentication = jwtAccessTokenConverter.extractAuthentication(tokenMap);
        if (oAuth2Authentication != null) {
            LOGGER.info("JWT token verified for: {}", oAuth2Authentication.getPrincipal());
        }
        return oAuth2Authentication;
    } catch (IOException e) {
        LOGGER.error("Failed to parse the JWT token", e);
        throw new InvalidTokenException("The specified JWT token is invalid", e);
    }
}
 

import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
/**
 * Fetches the public key from the UAA.
 *
 * @return the public key used to verify JWT tokens; or null.
 */
@Override
public SignatureVerifier getSignatureVerifier() throws Exception {
    try {
        HttpEntity<Void> request = new HttpEntity<Void>(new HttpHeaders());
        String key = (String) restTemplate
            .exchange(getPublicKeyEndpoint(), HttpMethod.GET, request, Map.class).getBody()
            .get("value");
        return new RsaVerifier(key);
    } catch (IllegalStateException ex) {
        log.warn("could not contact UAA to get public key");
        return null;
    }
}
 

import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
@Nullable
@Override
public BlueWebToken decodeAndVerify(@Nonnull final String idToken){

    final long now = System.currentTimeMillis();
    if(log.isTraceEnabled()){
        log.trace("Decoding token [" + idToken + "]");
    }
    try{

        Jwt jwt = JwtHelper.decode(idToken);
        // Get the key ID we need to use to verify the token
        String keyId = getKeyId(idToken);
        if("".equals(keyId.trim())){
            log.warn("Failed to retrieve key ID for token");
            return null;
        }
        BlueWebToken token = typeSecuredObjectMapper().readValue(
          jwt.getClaims(),
          BlueWebToken.class);
        // Get the key and verify the JWT signature
        RSAPublicKey key = rsaPublicKey(keyId, token.getAuthContextReference());
        jwt.verifySignature(new RsaVerifier(key));

        // Validate the nonce

        if(!nonceService.isValid(token.getNonce())){
            log.warn("Failed to validate nonce in token. This could be a replay attack.");
            return null;
        }
        if(!claimValidationService.validateAudience(token)){
            log.warn("Failed to validate audience in token. This could be a replay attack.");
            return null;
        }
        if(!claimValidationService.validateIssuer(token)){
            log.warn("Failed to validate issuer of token. This could be a replay attack.");
            return null;
        }
        if(!claimValidationService.validateNotBefore(token, now)){
            log.warn("Failed to validate notBefore time in token. This could be a replay attack. 'Now' milliseconds: " + now + "; 'NotBefore' milliseconds: " + token
              .getNotBefore()
              .toInstant()
              .toEpochMilli());
            return null;
        }
        if(!claimValidationService.validateExpiration(token, now)){
            log.warn("Failed to validate expiration time in token. This could be a replay attack. 'Now' milliseconds: " + now + "; 'Expiration' milliseconds: " + token
              .getExpiration()
              .toInstant()
              .toEpochMilli());
            return null;
        }

        return token;

    }catch(IOException | IllegalArgumentException | InvalidSignatureException x){
        log.warn("Failed to extract data from JWT token: " + x.getMessage(), x);
    }
    return null;
}
 

import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
private void downloadKeys(final String url) {
    Map<String, SignatureVerifier> tempVerifiers = new HashMap<>();
    ResponseEntity<Map> responseEntity = restTemplate.getForEntity(url, Map.class);
    Map response = responseEntity.getBody();

    for (Object key : response.keySet()) {
        String certificateString = (String)response.get(key);
        InputStream is = new ByteArrayInputStream(certificateString.getBytes(StandardCharsets.UTF_8));
        try {
            CertificateFactory f = CertificateFactory.getInstance("X.509");
            X509Certificate certificate = (X509Certificate)f.generateCertificate(is);
            PublicKey pk = certificate.getPublicKey();
            RsaVerifier verifier = new RsaVerifier((RSAPublicKey)pk);
            tempVerifiers.put((String)key, verifier);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    if (tempVerifiers.size() > 0) {
        // do we need to synchronize here?
        verifiers = tempVerifiers;
    }

    String cacheControlValue = responseEntity.getHeaders().getCacheControl();
    int maxAge = DEFAULT_MAX_AGE;
    if (cacheControlValue != null) {
        Matcher matcher = MAX_AGE_PATTERN.matcher(cacheControlValue);
        if (matcher.matches()) {
            maxAge = Integer.parseInt(matcher.group(1));
        }
    }

    // start timer to update keys
    timer.schedule(new TimerTask() {
        @Override
        public void run() {
            downloadKeys(url);
        }
    }, maxAge * 1000); // max-age is in seconds unit
}
 

import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
@Test
public void rsaSignedTokenParsesAndVerifies() {
	Jwt jwt = JwtHelper.decode(JOE_RSA_TOKEN);
	jwt.verifySignature(new RsaVerifier(N, E));
	assertEquals(JOE_CLAIM_SEGMENT, jwt.getClaims());
}
 

import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
@Test(expected = InvalidSignatureException.class)
public void invalidRsaSignatureRaisesException() {
	JwtHelper.decodeAndVerify(JOE_RSA_TOKEN, new RsaVerifier(N, D));
}
 

import org.springframework.security.jwt.crypto.sign.RsaVerifier; //导入依赖的package包/类
@Test
public void rsaVerificationIsInverseOfSigning() {
	Jwt jwt = JwtHelper.encode(JOE_CLAIM_SEGMENT, new RsaSigner(N, E));
	jwt.verifySignature(new RsaVerifier(N, D));
}