org.picketlink.json.jose

Class JWKBuilder<T extends JWK,B extends JWKBuilder<?,?>>

java.lang.Object

org.picketlink.json.jose.JWKBuilder<T,B>

Type Parameters:

T - the generic type

B - the generic type

public class JWKBuilder<T extends JWK,B extends JWKBuilder<?,?>>
extends Object

The base class for building JSON Web Keys (JWKs) with desired key parameters.

The following JSON object members are common to all JWK types:

• kty (required)
• use (optional)
• key_ops (optional)
• alg (optional)
• kid (required)
• x5u (optional)
• x5c (optional)
• x5t (optional)
• x5t#S256 (optional)

Author:

Giriraj Sharma

Constructor Summary

Constructors

Modifier	Constructor and Description
	JWKBuilder() Instantiates a new JWK builder.
protected	JWKBuilder(Class<T> tokenType) Instantiates a new JWK builder.

Method Summary

Methods

Modifier and Type	Method and Description
T	build() Builds JsonObjectBuilder of key parameters.
protected T	build(javax.json.JsonObject keyParametersObject) Builds the key JsonObject.
T	build(String json) Builds the String JSON.
JWKBuilder<T,B>	crtCoefficient(BigInteger crtCoefficient) Sets the The first Chinese Remainder Theorem coefficient of the private RSA key.
protected javax.json.JsonObjectBuilder	getkeyParametersBuilder() Gets the key parameters builder.
protected Class<T>	getTokenType() Gets token type.
JWKBuilder<T,B>	keyAlgorithm(String algorithm) The alg (algorithm) member identifies the algorithm intended for use with the key.
JWKBuilder<T,B>	keyIdentifier(String identifier) The kid (key ID) member can be used to match a specific key.
JWKBuilder<T,B>	keyOperations(String... keyOperations) The key_ops (key operations) member identifies the operation(s) that the key is intended to be used for.
JWKBuilder<T,B>	keyParameter(String name, String... value) Sets the Key parameter.
JWKBuilder<T,B>	keyType(String type) The kty (key type) member identifies the cryptographic algorithm family used with the key.
JWKBuilder<T,B>	keyUse(String use) The use (public key use) member identifies the intended use of the public key.
JWKBuilder<T,B>	modulus(BigInteger modulus) Sets the modulus value for the RSA key.
JWKBuilder<T,B>	primeExponentP(BigInteger primeExponentP) Sets the first factor Chinese Remainder Theorem exponent of the private RSA key.
JWKBuilder<T,B>	primeExponentQ(BigInteger primeExponentQ) Sets the second factor Chinese Remainder Theorem exponent of the private RSA key.
JWKBuilder<T,B>	primeP(BigInteger primeP) Sets the first prime factor of the private RSA key.
JWKBuilder<T,B>	primeQ(BigInteger primeQ) Sets second prime factor of the private RSA key.
JWKBuilder<T,B>	privateExponent(BigInteger privateExponent) Sets the private exponent of the RSA key.
JWKBuilder<T,B>	publicExponent(BigInteger publicExponent) Sets the public exponent of the RSA key.
JWKBuilder<T,B>	X509CertificateChain(String... X509CertificateChain) The x5c (X.509 Certificate Chain) member contains a chain of one or more PKIX certificates [RFC5280].
JWKBuilder<T,B>	X509CertificateSHA1Thumbprint(String sha1Thumbprint) The x5t (X.509 Certificate SHA-1 Thumbprint) member is a base64url encoded SHA-1 thumbprint (a.k.a.
JWKBuilder<T,B>	X509CertificateSHA256Thumbprint(String sha256Thumbprint) The x5t#S256 (X.509 Certificate SHA-256 Thumbprint) member is a base64url encoded SHA-256 thumbprint (a.k.a.
JWKBuilder<T,B>	X509Url(String url) The x5u (X.509 URL) member is a URI [RFC3986] that refers to a resource for an X.509 public key certificate or certificate chain [RFC5280].

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

JWKBuilder

public JWKBuilder()

Instantiates a new JWK builder.

JWKBuilder

protected JWKBuilder(Class<T> tokenType)

Instantiates a new JWK builder.

Parameters:

tokenTypeoken - type

Method Detail

getTokenType

protected Class<T> getTokenType()

Gets token type.

Returns:

token type

getkeyParametersBuilder

protected javax.json.JsonObjectBuilder getkeyParametersBuilder()

Gets the key parameters builder.

Returns:

the key parameters builder

keyType

public JWKBuilder<T,B> keyType(String type)

The kty (key type) member identifies the cryptographic algorithm family used with the key. kty values should either be registered in the IANA JSON Web Key Types registry defined in [JWA] or be a value that contains a Collision-Resistant Name. The kty value is a case-sensitive string. This member MUST be present in a JWK.

Parameters:

type -

Returns:

keyUse

public JWKBuilder<T,B> keyUse(String use)

The use (public key use) member identifies the intended use of the public key. The use parameter is intended for use cases in which it is useful to distinguish between public signing keys and public encryption keys. Values defined by this specification are:

• sig (signature)
• enc (encryption)

Other values MAY be used. Public Key Use values can be registered in the IANA JSON Web Key Use registry defined in Section 8.2. The use value is a case-sensitive string. Use of the use member is OPTIONAL, unless the application requires its presence.

Parameters:

use - the key use

Returns:

keyOperations

public JWKBuilder<T,B> keyOperations(String... keyOperations)

The key_ops (key operations) member identifies the operation(s) that the key is intended to be used for. The key_ops parameter is intended for use cases in which public, private, or symmetric keys may be present. Its value is an array of key operation values. Values defined by this specification are:

• sign (compute signature or MAC)
• verify (verify signature or MAC)
• encrypt (encrypt content)
• decrypt (decrypt content and validate decryption, if applicable)
• wrapKey (encrypt key)
• unwrapKey (decrypt key and validate decryption, if applicable)
• deriveKey (derive key)
• deriveBits (derive bits not to be used as a key).

Other values MAY be used. Key operation values can be registered in the IANA JSON Web Key Operations registry defined in Section 8.3. The key operation values are case-sensitive strings. Duplicate key operation values MUST NOT be present in the array.

Multiple unrelated key operations SHOULD NOT be specified for a key because of the potential vulnerabilities associated with using the same key with multiple algorithms. Thus, the combinations sign with verify, encrypt with decrypt, and wrapKey with unwrapKey are permitted, but other combinations SHOULD NOT be used.The use and key_ops JWK members SHOULD NOT be used together.

Parameters:

keyOperations - the key operations

Returns:

keyAlgorithm

public JWKBuilder<T,B> keyAlgorithm(String algorithm)

The alg (algorithm) member identifies the algorithm intended for use with the key. The values used should either be registered in the IANA JSON Web Signature and Encryption Algorithms registry defined in [JWA] or be a value that contains a Collision-Resistant Name. Use of this member is OPTIONAL.

Parameters:

algorithm - the algorithm

Returns:

keyIdentifier

public JWKBuilder<T,B> keyIdentifier(String identifier)

The kid (key ID) member can be used to match a specific key. This can be used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the kid value is unspecified. When kid values are used within a JWK Set, different keys within the JWK Set SHOULD use distinct kid values. (One example in which different keys might use the same kid value is if they have different kty (key type) values but are considered to be equivalent alternatives by the application using them.) The kid value is a case-sensitive string. Use of this member is OPTIONAL.

When used with JWS or JWE, the kid value is used to match a JWS or JWE kid Header Parameter value.

Parameters:

identifier - the identifier

Returns:

X509Url

public JWKBuilder<T,B> X509Url(String url)

The x5u (X.509 URL) member is a URI [RFC3986] that refers to a resource for an X.509 public key certificate or certificate chain [RFC5280]. The identified resource MUST provide a representation of the certificate or certificate chain that conforms to RFC 5280 [RFC5280] in PEM encoded form [RFC1421]. The key in the first certificate MUST match the public key represented by other members of the JWK. The protocol used to acquire the resource MUST provide integrity protection; an HTTP GET request to retrieve the certificate MUST use TLS [RFC2818, RFC5246]; the identity of the server MUST be validated, as per Section 6 of RFC 6125 [RFC6125]. Use of this member is OPTIONAL.

Parameters:

url - the url

Returns:

X509CertificateChain

public JWKBuilder<T,B> X509CertificateChain(String... X509CertificateChain)

The x5c (X.509 Certificate Chain) member contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each string in the array is a base64 encoded ([RFC4648] Section 4 -- not base64url encoded) DER [ITU.X690.1994] PKIX certificate value. The PKIX certificate containing the key value MUST be the first certificate. This MAY be followed by additional certificates, with each subsequent certificate being the one used to certify the previous one. The key in the first certificate MUST match the public key represented by other members of the JWK. Use of this member is OPTIONAL.

Parameters:

X509CertificateChain - the x509 certificate chain

Returns:

X509CertificateSHA1Thumbprint

public JWKBuilder<T,B> X509CertificateSHA1Thumbprint(String sha1Thumbprint)

The x5t (X.509 Certificate SHA-1 Thumbprint) member is a base64url encoded SHA-1 thumbprint (a.k.a. digest) of the DER encoding of an X.509 certificate [RFC5280]. The key in the certificate MUST match the public key represented by other members of the JWK. Use of this member is OPTIONAL.

Parameters:

sha1Thumbprint - the SHA1 thumbprint

Returns:

X509CertificateSHA256Thumbprint

public JWKBuilder<T,B> X509CertificateSHA256Thumbprint(String sha256Thumbprint)

The x5t#S256 (X.509 Certificate SHA-256 Thumbprint) member is a base64url encoded SHA-256 thumbprint (a.k.a. digest) of the DER encoding of an X.509 certificate [RFC5280]. The key in the certificate MUST match the public key represented by other members of the JWK. Use of this member is OPTIONAL.

Parameters:

sha256Thumbprint - the SHA256 thumbprint

Returns:

modulus

public JWKBuilder<T,B> modulus(BigInteger modulus)

Sets the modulus value for the RSA key.

Parameters:

modulus - the modulus

Returns:

publicExponent

public JWKBuilder<T,B> publicExponent(BigInteger publicExponent)

Sets the public exponent of the RSA key.

Parameters:

publicExponent - the public exponent

Returns:

privateExponent

public JWKBuilder<T,B> privateExponent(BigInteger privateExponent)

Sets the private exponent of the RSA key.

Parameters:

privateExponent - the private exponent

Returns:

primeP

public JWKBuilder<T,B> primeP(BigInteger primeP)

Sets the first prime factor of the private RSA key.

Parameters:

primeP - the prime p

Returns:

primeQ

public JWKBuilder<T,B> primeQ(BigInteger primeQ)

Sets second prime factor of the private RSA key.

Parameters:

primeQ - the prime q

Returns:

primeExponentP

public JWKBuilder<T,B> primeExponentP(BigInteger primeExponentP)

Sets the first factor Chinese Remainder Theorem exponent of the private RSA key.

Parameters:

primeExponentP - the prime exponent p

Returns:

primeExponentQ

public JWKBuilder<T,B> primeExponentQ(BigInteger primeExponentQ)

Sets the second factor Chinese Remainder Theorem exponent of the private RSA key.

Parameters:

primeExponentQ - the prime exponent q

Returns:

crtCoefficient

public JWKBuilder<T,B> crtCoefficient(BigInteger crtCoefficient)

Sets the The first Chinese Remainder Theorem coefficient of the private RSA key.

Parameters:

crtCoefficient - the CRT coefficient

Returns:

keyParameter

public JWKBuilder<T,B> keyParameter(String name,
                           String... value)

Sets the Key parameter.

Parameters:

name - the name of key parameter

value - the value(s) of key parameter

Returns:

build

public T build()

Builds JsonObjectBuilder of key parameters.

Returns:

build

public T build(String json)

Builds the String JSON.

Parameters:

json - the JSON formatted string

Returns:

build

protected T build(javax.json.JsonObject keyParametersObject)

Builds the key JsonObject.

Parameters:

keyParametersObject - the key parameters object

Returns: