Splitting current jose module into jose-core + jose-jaxrs
Conflicts:
rt/rs/security/jose/pom.xml
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/5e40ea35
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/5e40ea35
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/5e40ea35
Branch: refs/heads/3.0.x-fixes
Commit: 5e40ea351fa45006513f0fbc7d80747d321f12b4
Parents: 75cae0f
Author: Colm O hEigeartaigh <[email protected]>
Authored: Tue Oct 13 11:10:18 2015 +0100
Committer: Colm O hEigeartaigh <[email protected]>
Committed: Tue Oct 13 11:36:39 2015 +0100
----------------------------------------------------------------------
rt/rs/security/jose/jose-core/pom.xml | 69 ++
.../rs/security/jose/AbstractJoseConsumer.java | 51 ++
.../rs/security/jose/AbstractJoseProducer.java | 51 ++
.../cxf/rs/security/jose/JoseConstants.java | 54 ++
.../cxf/rs/security/jose/JoseException.java | 33 +
.../cxf/rs/security/jose/JoseHeaders.java | 179 +++++
.../apache/cxf/rs/security/jose/JoseType.java | 43 ++
.../apache/cxf/rs/security/jose/JoseUtils.java | 200 ++++++
.../jose/common/KeyManagementUtils.java | 390 +++++++++++
.../jose/common/PrivateKeyPasswordProvider.java | 25 +
.../rs/security/jose/jwa/AlgorithmUtils.java | 271 ++++++++
.../rs/security/jose/jwa/ContentAlgorithm.java | 70 ++
.../cxf/rs/security/jose/jwa/KeyAlgorithm.java | 78 +++
.../security/jose/jwa/SignatureAlgorithm.java | 83 +++
.../jwe/AbstractContentEncryptionAlgorithm.java | 60 ++
...stractContentEncryptionCipherProperties.java | 51 ++
.../jose/jwe/AbstractJweDecryption.java | 113 ++++
.../jose/jwe/AbstractJweEncryption.java | 243 +++++++
.../jwe/AbstractWrapKeyEncryptionAlgorithm.java | 105 +++
.../jose/jwe/AesCbcHmacJweDecryption.java | 91 +++
.../jose/jwe/AesCbcHmacJweEncryption.java | 175 +++++
.../jwe/AesGcmContentDecryptionAlgorithm.java | 41 ++
.../jwe/AesGcmContentEncryptionAlgorithm.java | 55 ++
.../jwe/AesGcmWrapKeyDecryptionAlgorithm.java | 78 +++
.../jwe/AesGcmWrapKeyEncryptionAlgorithm.java | 65 ++
.../jose/jwe/AesWrapKeyDecryptionAlgorithm.java | 59 ++
.../jose/jwe/AesWrapKeyEncryptionAlgorithm.java | 48 ++
.../jose/jwe/AuthenticationTagProducer.java | 24 +
.../jose/jwe/ContentDecryptionProvider.java | 24 +
.../jwe/ContentEncryptionCipherProperties.java | 30 +
.../jose/jwe/ContentEncryptionProvider.java | 26 +
.../jose/jwe/DirectKeyDecryptionAlgorithm.java | 56 ++
.../jose/jwe/DirectKeyEncryptionAlgorithm.java | 42 ++
.../jose/jwe/DirectKeyJweDecryption.java | 32 +
.../jose/jwe/DirectKeyJweEncryption.java | 27 +
.../jwe/EcdhAesWrapKeyDecryptionAlgorithm.java | 54 ++
.../jwe/EcdhAesWrapKeyEncryptionAlgorithm.java | 82 +++
.../jose/jwe/EcdhDirectKeyJweDecryption.java | 58 ++
.../jose/jwe/EcdhDirectKeyJweEncryption.java | 118 ++++
.../security/jose/jwe/JweCompactConsumer.java | 125 ++++
.../security/jose/jwe/JweCompactProducer.java | 129 ++++
.../cxf/rs/security/jose/jwe/JweDecryption.java | 28 +
.../security/jose/jwe/JweDecryptionInput.java | 68 ++
.../security/jose/jwe/JweDecryptionOutput.java | 45 ++
.../jose/jwe/JweDecryptionProvider.java | 26 +
.../cxf/rs/security/jose/jwe/JweEncryption.java | 29 +
.../security/jose/jwe/JweEncryptionInput.java | 90 +++
.../security/jose/jwe/JweEncryptionOutput.java | 78 +++
.../jose/jwe/JweEncryptionProvider.java | 33 +
.../cxf/rs/security/jose/jwe/JweException.java | 53 ++
.../cxf/rs/security/jose/jwe/JweHeaders.java | 118 ++++
.../rs/security/jose/jwe/JweJsonConsumer.java | 191 ++++++
.../jose/jwe/JweJsonEncryptionEntry.java | 60 ++
.../rs/security/jose/jwe/JweJsonProducer.java | 192 ++++++
.../jose/jwe/JweJwtCompactConsumer.java | 63 ++
.../jose/jwe/JweJwtCompactProducer.java | 60 ++
.../rs/security/jose/jwe/JweKeyProperties.java | 29 +
.../rs/security/jose/jwe/JweOutputStream.java | 148 +++++
.../cxf/rs/security/jose/jwe/JweUtils.java | 633 ++++++++++++++++++
.../jose/jwe/KeyDecryptionProvider.java | 27 +
.../jose/jwe/KeyEncryptionProvider.java | 27 +
.../PbesHmacAesWrapKeyDecryptionAlgorithm.java | 77 +++
.../PbesHmacAesWrapKeyEncryptionAlgorithm.java | 192 ++++++
.../jose/jwe/RSAKeyDecryptionAlgorithm.java | 46 ++
.../jose/jwe/RSAKeyEncryptionAlgorithm.java | 34 +
.../jose/jwe/WrappedKeyDecryptionAlgorithm.java | 97 +++
.../jose/jwk/DefaultJwkReaderWriter.java | 49 ++
.../cxf/rs/security/jose/jwk/JsonWebKey.java | 180 +++++
.../cxf/rs/security/jose/jwk/JsonWebKeys.java | 130 ++++
.../cxf/rs/security/jose/jwk/JwkException.java | 35 +
.../rs/security/jose/jwk/JwkReaderWriter.java | 27 +
.../cxf/rs/security/jose/jwk/JwkUtils.java | 532 +++++++++++++++
.../cxf/rs/security/jose/jwk/KeyOperation.java | 46 ++
.../cxf/rs/security/jose/jwk/KeyType.java | 44 ++
.../cxf/rs/security/jose/jwk/PublicKeyUse.java | 46 ++
.../jose/jws/AbstractJwsSignatureProvider.java | 76 +++
.../jose/jws/EcDsaJwsSignatureProvider.java | 110 +++
.../jose/jws/EcDsaJwsSignatureVerifier.java | 81 +++
.../jose/jws/HmacJwsSignatureProvider.java | 76 +++
.../jose/jws/HmacJwsSignatureVerifier.java | 85 +++
.../security/jose/jws/JwsCompactConsumer.java | 149 +++++
.../security/jose/jws/JwsCompactProducer.java | 136 ++++
.../cxf/rs/security/jose/jws/JwsException.java | 49 ++
.../cxf/rs/security/jose/jws/JwsHeaders.java | 66 ++
.../rs/security/jose/jws/JwsJsonConsumer.java | 189 ++++++
.../security/jose/jws/JwsJsonOutputStream.java | 100 +++
.../rs/security/jose/jws/JwsJsonProducer.java | 212 ++++++
.../jose/jws/JwsJsonSignatureEntry.java | 163 +++++
.../jose/jws/JwsJwtCompactConsumer.java | 43 ++
.../jose/jws/JwsJwtCompactProducer.java | 44 ++
.../rs/security/jose/jws/JwsOutputStream.java | 59 ++
.../cxf/rs/security/jose/jws/JwsSignature.java | 25 +
.../security/jose/jws/JwsSignatureProvider.java | 31 +
.../security/jose/jws/JwsSignatureVerifier.java | 26 +
.../cxf/rs/security/jose/jws/JwsUtils.java | 401 +++++++++++
.../jose/jws/NoneJwsSignatureProvider.java | 55 ++
.../jose/jws/NoneJwsSignatureVerifier.java | 36 +
.../jws/PrivateKeyJwsSignatureProvider.java | 91 +++
.../jose/jws/PublicKeyJwsSignatureVerifier.java | 80 +++
.../jose/jwt/AbstractJoseJwtConsumer.java | 96 +++
.../jose/jwt/AbstractJoseJwtProducer.java | 84 +++
.../cxf/rs/security/jose/jwt/JwtClaims.java | 102 +++
.../cxf/rs/security/jose/jwt/JwtConstants.java | 38 ++
.../cxf/rs/security/jose/jwt/JwtException.java | 35 +
.../cxf/rs/security/jose/jwt/JwtToken.java | 56 ++
.../security/jose/jwt/JwtTokenReaderWriter.java | 55 ++
.../cxf/rs/security/jose/jwt/JwtUtils.java | 107 +++
.../jose/cookbook/JwkJoseCookBookTest.java | 187 ++++++
.../jose/cookbook/JwsJoseCookBookTest.java | 665 +++++++++++++++++++
.../jose/cookbook/cookbookPrivateSet.txt | 24 +
.../jose/cookbook/cookbookPublicSet.txt | 16 +
.../jose/cookbook/cookbookSecretSet.txt | 16 +
.../jose/jwe/JweCompactReaderWriterTest.java | 288 ++++++++
.../security/jose/jwe/JweJsonConsumerTest.java | 184 +++++
.../security/jose/jwe/JweJsonProducerTest.java | 328 +++++++++
.../jose/jwe/JwePbeHmacAesWrapTest.java | 86 +++
.../rs/security/jose/jwk/JsonWebKeyTest.java | 231 +++++++
.../cxf/rs/security/jose/jwk/JwkUtilsTest.java | 94 +++
.../cxf/rs/security/jose/jwk/jwkPrivateSet.txt | 23 +
.../cxf/rs/security/jose/jwk/jwkPublicSet.txt | 27 +
.../cxf/rs/security/jose/jwk/jwkSecretSet.txt | 13 +
.../security/jose/jws/JwsCompactHeaderTest.java | 203 ++++++
.../jose/jws/JwsCompactReaderWriterTest.java | 307 +++++++++
.../security/jose/jws/JwsJsonConsumerTest.java | 89 +++
.../security/jose/jws/JwsJsonProducerTest.java | 126 ++++
.../jose/jws/jwkPublicJsonConsumerSet.txt | 18 +
rt/rs/security/jose/jose-jaxrs/pom.xml | 61 ++
.../jose/jaxrs/AbstractJweDecryptingFilter.java | 62 ++
.../jaxrs/AbstractJwsJsonReaderProvider.java | 91 +++
.../jaxrs/AbstractJwsJsonWriterProvider.java | 86 +++
.../jose/jaxrs/AbstractJwsReaderProvider.java | 48 ++
.../jose/jaxrs/AbstractJwsWriterProvider.java | 58 ++
.../jose/jaxrs/JsonWebKeysProvider.java | 48 ++
.../jose/jaxrs/JweClientResponseFilter.java | 46 ++
.../jose/jaxrs/JweContainerRequestFilter.java | 50 ++
.../jose/jaxrs/JweWriterInterceptor.java | 133 ++++
.../jose/jaxrs/JwsClientResponseFilter.java | 53 ++
.../jose/jaxrs/JwsContainerRequestFilter.java | 61 ++
.../jose/jaxrs/JwsJsonClientResponseFilter.java | 59 ++
.../jaxrs/JwsJsonContainerRequestFilter.java | 65 ++
.../jose/jaxrs/JwsJsonWriterInterceptor.java | 138 ++++
.../jose/jaxrs/JwsWriterInterceptor.java | 107 +++
.../jaxrs/JwtAuthenticationClientFilter.java | 84 +++
.../jose/jaxrs/JwtAuthenticationFilter.java | 113 ++++
.../jose/jaxrs/JwtTokenSecurityContext.java | 81 +++
.../cxf/rs/security/jose/jaxrs/Priorities.java | 34 +
rt/rs/security/jose/pom.xml | 54 +-
.../rs/security/jose/AbstractJoseConsumer.java | 51 --
.../rs/security/jose/AbstractJoseProducer.java | 51 --
.../cxf/rs/security/jose/JoseConstants.java | 54 --
.../cxf/rs/security/jose/JoseException.java | 33 -
.../cxf/rs/security/jose/JoseHeaders.java | 179 -----
.../apache/cxf/rs/security/jose/JoseType.java | 43 --
.../apache/cxf/rs/security/jose/JoseUtils.java | 125 ----
.../jose/jaxrs/AbstractJweDecryptingFilter.java | 62 --
.../jaxrs/AbstractJwsJsonReaderProvider.java | 91 ---
.../jaxrs/AbstractJwsJsonWriterProvider.java | 86 ---
.../jose/jaxrs/AbstractJwsReaderProvider.java | 48 --
.../jose/jaxrs/AbstractJwsWriterProvider.java | 58 --
.../jose/jaxrs/JsonWebKeysProvider.java | 48 --
.../jose/jaxrs/JweClientResponseFilter.java | 46 --
.../jose/jaxrs/JweContainerRequestFilter.java | 50 --
.../jose/jaxrs/JweWriterInterceptor.java | 133 ----
.../jose/jaxrs/JwsClientResponseFilter.java | 53 --
.../jose/jaxrs/JwsContainerRequestFilter.java | 61 --
.../jose/jaxrs/JwsJsonClientResponseFilter.java | 59 --
.../jaxrs/JwsJsonContainerRequestFilter.java | 65 --
.../jose/jaxrs/JwsJsonWriterInterceptor.java | 138 ----
.../jose/jaxrs/JwsWriterInterceptor.java | 107 ---
.../jaxrs/JwtAuthenticationClientFilter.java | 84 ---
.../jose/jaxrs/JwtAuthenticationFilter.java | 113 ----
.../jose/jaxrs/JwtTokenSecurityContext.java | 81 ---
.../security/jose/jaxrs/KeyManagementUtils.java | 389 -----------
.../cxf/rs/security/jose/jaxrs/Priorities.java | 34 -
.../jose/jaxrs/PrivateKeyPasswordProvider.java | 25 -
.../rs/security/jose/jwa/AlgorithmUtils.java | 271 --------
.../rs/security/jose/jwa/ContentAlgorithm.java | 70 --
.../cxf/rs/security/jose/jwa/KeyAlgorithm.java | 78 ---
.../security/jose/jwa/SignatureAlgorithm.java | 83 ---
.../jwe/AbstractContentEncryptionAlgorithm.java | 60 --
...stractContentEncryptionCipherProperties.java | 51 --
.../jose/jwe/AbstractJweDecryption.java | 113 ----
.../jose/jwe/AbstractJweEncryption.java | 243 -------
.../jwe/AbstractWrapKeyEncryptionAlgorithm.java | 105 ---
.../jose/jwe/AesCbcHmacJweDecryption.java | 91 ---
.../jose/jwe/AesCbcHmacJweEncryption.java | 175 -----
.../jwe/AesGcmContentDecryptionAlgorithm.java | 41 --
.../jwe/AesGcmContentEncryptionAlgorithm.java | 55 --
.../jwe/AesGcmWrapKeyDecryptionAlgorithm.java | 78 ---
.../jwe/AesGcmWrapKeyEncryptionAlgorithm.java | 65 --
.../jose/jwe/AesWrapKeyDecryptionAlgorithm.java | 59 --
.../jose/jwe/AesWrapKeyEncryptionAlgorithm.java | 48 --
.../jose/jwe/AuthenticationTagProducer.java | 24 -
.../jose/jwe/ContentDecryptionProvider.java | 24 -
.../jwe/ContentEncryptionCipherProperties.java | 30 -
.../jose/jwe/ContentEncryptionProvider.java | 26 -
.../jose/jwe/DirectKeyDecryptionAlgorithm.java | 56 --
.../jose/jwe/DirectKeyEncryptionAlgorithm.java | 42 --
.../jose/jwe/DirectKeyJweDecryption.java | 32 -
.../jose/jwe/DirectKeyJweEncryption.java | 27 -
.../jwe/EcdhAesWrapKeyDecryptionAlgorithm.java | 54 --
.../jwe/EcdhAesWrapKeyEncryptionAlgorithm.java | 82 ---
.../jose/jwe/EcdhDirectKeyJweDecryption.java | 58 --
.../jose/jwe/EcdhDirectKeyJweEncryption.java | 118 ----
.../security/jose/jwe/JweCompactConsumer.java | 125 ----
.../security/jose/jwe/JweCompactProducer.java | 129 ----
.../cxf/rs/security/jose/jwe/JweDecryption.java | 28 -
.../security/jose/jwe/JweDecryptionInput.java | 68 --
.../security/jose/jwe/JweDecryptionOutput.java | 45 --
.../jose/jwe/JweDecryptionProvider.java | 26 -
.../cxf/rs/security/jose/jwe/JweEncryption.java | 29 -
.../security/jose/jwe/JweEncryptionInput.java | 90 ---
.../security/jose/jwe/JweEncryptionOutput.java | 78 ---
.../jose/jwe/JweEncryptionProvider.java | 33 -
.../cxf/rs/security/jose/jwe/JweException.java | 53 --
.../cxf/rs/security/jose/jwe/JweHeaders.java | 118 ----
.../rs/security/jose/jwe/JweJsonConsumer.java | 191 ------
.../jose/jwe/JweJsonEncryptionEntry.java | 60 --
.../rs/security/jose/jwe/JweJsonProducer.java | 192 ------
.../jose/jwe/JweJwtCompactConsumer.java | 63 --
.../jose/jwe/JweJwtCompactProducer.java | 60 --
.../rs/security/jose/jwe/JweKeyProperties.java | 29 -
.../rs/security/jose/jwe/JweOutputStream.java | 148 -----
.../cxf/rs/security/jose/jwe/JweUtils.java | 634 ------------------
.../jose/jwe/KeyDecryptionProvider.java | 27 -
.../jose/jwe/KeyEncryptionProvider.java | 27 -
.../PbesHmacAesWrapKeyDecryptionAlgorithm.java | 77 ---
.../PbesHmacAesWrapKeyEncryptionAlgorithm.java | 192 ------
.../jose/jwe/RSAKeyDecryptionAlgorithm.java | 46 --
.../jose/jwe/RSAKeyEncryptionAlgorithm.java | 34 -
.../jose/jwe/WrappedKeyDecryptionAlgorithm.java | 97 ---
.../jose/jwk/DefaultJwkReaderWriter.java | 49 --
.../cxf/rs/security/jose/jwk/JsonWebKey.java | 180 -----
.../cxf/rs/security/jose/jwk/JsonWebKeys.java | 130 ----
.../cxf/rs/security/jose/jwk/JwkException.java | 35 -
.../rs/security/jose/jwk/JwkReaderWriter.java | 27 -
.../cxf/rs/security/jose/jwk/JwkUtils.java | 533 ---------------
.../cxf/rs/security/jose/jwk/KeyOperation.java | 46 --
.../cxf/rs/security/jose/jwk/KeyType.java | 44 --
.../cxf/rs/security/jose/jwk/PublicKeyUse.java | 46 --
.../jose/jws/AbstractJwsSignatureProvider.java | 76 ---
.../jose/jws/EcDsaJwsSignatureProvider.java | 110 ---
.../jose/jws/EcDsaJwsSignatureVerifier.java | 81 ---
.../jose/jws/HmacJwsSignatureProvider.java | 76 ---
.../jose/jws/HmacJwsSignatureVerifier.java | 85 ---
.../security/jose/jws/JwsCompactConsumer.java | 149 -----
.../security/jose/jws/JwsCompactProducer.java | 136 ----
.../cxf/rs/security/jose/jws/JwsException.java | 49 --
.../cxf/rs/security/jose/jws/JwsHeaders.java | 66 --
.../rs/security/jose/jws/JwsJsonConsumer.java | 191 ------
.../security/jose/jws/JwsJsonOutputStream.java | 100 ---
.../rs/security/jose/jws/JwsJsonProducer.java | 210 ------
.../jose/jws/JwsJsonSignatureEntry.java | 163 -----
.../jose/jws/JwsJwtCompactConsumer.java | 43 --
.../jose/jws/JwsJwtCompactProducer.java | 44 --
.../rs/security/jose/jws/JwsOutputStream.java | 59 --
.../cxf/rs/security/jose/jws/JwsSignature.java | 25 -
.../security/jose/jws/JwsSignatureProvider.java | 31 -
.../security/jose/jws/JwsSignatureVerifier.java | 26 -
.../cxf/rs/security/jose/jws/JwsUtils.java | 396 -----------
.../jose/jws/NoneJwsSignatureProvider.java | 55 --
.../jose/jws/NoneJwsSignatureVerifier.java | 36 -
.../jws/PrivateKeyJwsSignatureProvider.java | 91 ---
.../jose/jws/PublicKeyJwsSignatureVerifier.java | 80 ---
.../jose/jwt/AbstractJoseJwtConsumer.java | 96 ---
.../jose/jwt/AbstractJoseJwtProducer.java | 84 ---
.../cxf/rs/security/jose/jwt/JwtClaims.java | 102 ---
.../cxf/rs/security/jose/jwt/JwtConstants.java | 38 --
.../cxf/rs/security/jose/jwt/JwtException.java | 35 -
.../cxf/rs/security/jose/jwt/JwtToken.java | 56 --
.../security/jose/jwt/JwtTokenReaderWriter.java | 55 --
.../cxf/rs/security/jose/jwt/JwtUtils.java | 107 ---
.../jose/cookbook/JwkJoseCookBookTest.java | 187 ------
.../jose/cookbook/JwsJoseCookBookTest.java | 665 -------------------
.../jose/cookbook/cookbookPrivateSet.txt | 24 -
.../jose/cookbook/cookbookPublicSet.txt | 16 -
.../jose/cookbook/cookbookSecretSet.txt | 16 -
.../jose/jwe/JweCompactReaderWriterTest.java | 288 --------
.../security/jose/jwe/JweJsonConsumerTest.java | 184 -----
.../security/jose/jwe/JweJsonProducerTest.java | 328 ---------
.../jose/jwe/JwePbeHmacAesWrapTest.java | 86 ---
.../rs/security/jose/jwk/JsonWebKeyTest.java | 231 -------
.../cxf/rs/security/jose/jwk/JwkUtilsTest.java | 94 ---
.../cxf/rs/security/jose/jwk/jwkPrivateSet.txt | 23 -
.../cxf/rs/security/jose/jwk/jwkPublicSet.txt | 27 -
.../cxf/rs/security/jose/jwk/jwkSecretSet.txt | 13 -
.../security/jose/jws/JwsCompactHeaderTest.java | 203 ------
.../jose/jws/JwsCompactReaderWriterTest.java | 307 ---------
.../security/jose/jws/JwsJsonConsumerTest.java | 89 ---
.../security/jose/jws/JwsJsonProducerTest.java | 126 ----
.../jose/jws/jwkPublicJsonConsumerSet.txt | 18 -
291 files changed, 14514 insertions(+), 14331 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/pom.xml
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/jose-core/pom.xml
b/rt/rs/security/jose/jose-core/pom.xml
new file mode 100644
index 0000000..3903acf
--- /dev/null
+++ b/rt/rs/security/jose/jose-core/pom.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/maven-v4_0_0.xsd";>
+ <modelVersion>4.0.0</modelVersion>
+ <artifactId>cxf-rt-rs-security-jose-core</artifactId>
+ <packaging>bundle</packaging>
+ <name>Apache CXF Runtime JOSE Core</name>
+ <description>Apache CXF Runtime JOSE Core</description>
+ <url>http://cxf.apache.org</url>
+ <parent>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-parent</artifactId>
+ <version>3.1.4-SNAPSHOT</version>
+ <relativePath>../../../../../parent/pom.xml</relativePath>
+ </parent>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-core</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-rt-security</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-rt-rs-extension-providers</artifactId>
+ <version>${project.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bcprov-ext-jdk15on</artifactId>
+ <version>${cxf.bcprov.version}</version>
+ <scope>provided</scope>
+ <optional>true</optional>
+ </dependency>
+ <!--test dependencies-->
+ <dependency>
+ <groupId>junit</groupId>
+ <artifactId>junit</artifactId>
+ <scope>test</scope>
+ </dependency>
+ </dependencies>
+</project>
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseConsumer.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseConsumer.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseConsumer.java
new file mode 100644
index 0000000..98886ce
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseConsumer.java
@@ -0,0 +1,51 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose;
+
+import org.apache.cxf.rs.security.jose.jwe.JweDecryptionProvider;
+import org.apache.cxf.rs.security.jose.jwe.JweUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
+import org.apache.cxf.rs.security.jose.jws.JwsUtils;
+
+public abstract class AbstractJoseConsumer {
+ private JweDecryptionProvider jweDecryptor;
+ private JwsSignatureVerifier jwsVerifier;
+
+ public void setJweDecryptor(JweDecryptionProvider jweDecryptor) {
+ this.jweDecryptor = jweDecryptor;
+ }
+
+ public void setJwsVerifier(JwsSignatureVerifier theJwsVerifier) {
+ this.jwsVerifier = theJwsVerifier;
+ }
+
+ protected JweDecryptionProvider getInitializedDecryptionProvider() {
+ if (jweDecryptor != null) {
+ return jweDecryptor;
+ }
+ return JweUtils.loadDecryptionProvider(false);
+ }
+ protected JwsSignatureVerifier getInitializedSignatureVerifier() {
+ if (jwsVerifier != null) {
+ return jwsVerifier;
+ }
+ return JwsUtils.loadSignatureVerifier(false);
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseProducer.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseProducer.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseProducer.java
new file mode 100644
index 0000000..f506943
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/AbstractJoseProducer.java
@@ -0,0 +1,51 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose;
+
+import org.apache.cxf.rs.security.jose.jwe.JweEncryptionProvider;
+import org.apache.cxf.rs.security.jose.jwe.JweUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider;
+import org.apache.cxf.rs.security.jose.jws.JwsUtils;
+
+public abstract class AbstractJoseProducer {
+ private JwsSignatureProvider sigProvider;
+ private JweEncryptionProvider encryptionProvider;
+
+ protected JwsSignatureProvider getInitializedSignatureProvider() {
+ if (sigProvider != null) {
+ return sigProvider;
+ }
+
+ return JwsUtils.loadSignatureProvider(false);
+ }
+ protected JweEncryptionProvider getInitializedEncryptionProvider() {
+ if (encryptionProvider != null) {
+ return encryptionProvider;
+ }
+ return JweUtils.loadEncryptionProvider(false);
+ }
+
+ public void setEncryptionProvider(JweEncryptionProvider
encryptionProvider) {
+ this.encryptionProvider = encryptionProvider;
+ }
+
+ public void setSignatureProvider(JwsSignatureProvider signatureProvider) {
+ this.sigProvider = signatureProvider;
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseConstants.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseConstants.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseConstants.java
new file mode 100644
index 0000000..0c04791
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseConstants.java
@@ -0,0 +1,54 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.rs.security.jose;
+
+public final class JoseConstants {
+ public static final String HEADER_TYPE = "typ";
+ public static final String HEADER_ALGORITHM = "alg";
+ public static final String HEADER_CONTENT_TYPE = "cty";
+ public static final String HEADER_CRITICAL = "crit";
+
+ public static final String HEADER_KEY_ID = "kid";
+ public static final String HEADER_X509_URL = "x5u";
+ public static final String HEADER_X509_CHAIN = "x5c";
+ public static final String HEADER_X509_THUMBPRINT = "x5t";
+ public static final String HEADER_X509_THUMBPRINT_SHA256 = "x5t#S256";
+ public static final String HEADER_JSON_WEB_KEY = "jwk";
+ public static final String HEADER_JSON_WEB_KEY_SET = "jku";
+
+ public static final String JWE_HEADER_KEY_ENC_ALGORITHM = HEADER_ALGORITHM;
+ public static final String JWE_HEADER_CONTENT_ENC_ALGORITHM = "enc";
+ public static final String JWE_HEADER_ZIP_ALGORITHM = "zip";
+ public static final String JWE_DEFLATE_ZIP_ALGORITHM = "DEF";
+
+ public static final String JWS_HEADER_B64_STATUS_HEADER = "b64";
+
+ public static final String TYPE_JWT = "JWT";
+ public static final String TYPE_JOSE = "JOSE";
+ public static final String TYPE_JOSE_JSON = "JOSE+JSON";
+ public static final String MEDIA_TYPE_JOSE = "application/jose";
+ public static final String MEDIA_TYPE_JOSE_JSON = "application/jose+json";
+
+ public static final String JOSE_CONTEXT_PROPERTY =
"org.apache.cxf.jose.context";
+
+ private JoseConstants() {
+
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseException.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseException.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseException.java
new file mode 100644
index 0000000..a71a098
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseException.java
@@ -0,0 +1,33 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose;
+
+public class JoseException extends RuntimeException {
+
+ private static final long serialVersionUID = 4118589816228511524L;
+ public JoseException() {
+
+ }
+ public JoseException(String error) {
+ super(error);
+ }
+ public JoseException(Throwable cause) {
+ super(cause);
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseHeaders.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseHeaders.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseHeaders.java
new file mode 100644
index 0000000..add5408
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseHeaders.java
@@ -0,0 +1,179 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.rs.security.jose;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cxf.helpers.CastUtils;
+import org.apache.cxf.jaxrs.provider.json.JsonMapObject;
+import org.apache.cxf.rs.security.jose.jwk.JsonWebKey;
+
+public abstract class JoseHeaders extends JsonMapObject {
+ public JoseHeaders() {
+ }
+
+ public JoseHeaders(JoseType type) {
+ init(type);
+ }
+
+ public JoseHeaders(JoseHeaders headers) {
+ this(headers.asMap());
+ }
+
+ public JoseHeaders(Map<String, Object> values) {
+ super(values);
+ }
+ private void init(JoseType type) {
+ setType(type);
+ }
+ public void setType(JoseType type) {
+ setHeader(JoseConstants.HEADER_TYPE, type.toString());
+ }
+
+ public JoseType getType() {
+ Object prop = getHeader(JoseConstants.HEADER_TYPE);
+ return prop == null ? null : JoseType.getType(prop.toString());
+ }
+
+ public void setContentType(String type) {
+ setHeader(JoseConstants.HEADER_CONTENT_TYPE, type);
+ }
+
+ public String getContentType() {
+ return (String)getHeader(JoseConstants.HEADER_CONTENT_TYPE);
+ }
+
+ public void setAlgorithm(String algo) {
+ setHeader(JoseConstants.HEADER_ALGORITHM, algo);
+ }
+
+ public String getAlgorithm() {
+ Object prop = getHeader(JoseConstants.HEADER_ALGORITHM);
+ return prop == null ? null : prop.toString();
+ }
+
+ public void setKeyId(String kid) {
+ setHeader(JoseConstants.HEADER_KEY_ID, kid);
+ }
+
+ public String getKeyId() {
+ return (String)getHeader(JoseConstants.HEADER_KEY_ID);
+ }
+
+ public void setX509Url(String x509Url) {
+ setHeader(JoseConstants.HEADER_X509_URL, x509Url);
+ }
+
+ public String getX509Url() {
+ return (String)getHeader(JoseConstants.HEADER_X509_URL);
+ }
+
+ public void setX509Chain(List<String> x509Chain) {
+ setProperty(JoseConstants.HEADER_X509_CHAIN, x509Chain);
+ }
+
+ public List<String> getX509Chain() {
+ return
CastUtils.cast((List<?>)getProperty(JoseConstants.HEADER_X509_CHAIN));
+ }
+
+ public void setX509Thumbprint(String x509Thumbprint) {
+ setHeader(JoseConstants.HEADER_X509_THUMBPRINT, x509Thumbprint);
+ }
+
+ public String getX509Thumbprint() {
+ return (String)getHeader(JoseConstants.HEADER_X509_THUMBPRINT);
+ }
+
+ public void setX509ThumbprintSHA256(String x509Thumbprint) {
+ setHeader(JoseConstants.HEADER_X509_THUMBPRINT_SHA256, x509Thumbprint);
+ }
+
+ public String getX509ThumbprintSHA256() {
+ return (String)getHeader(JoseConstants.HEADER_X509_THUMBPRINT_SHA256);
+ }
+
+ public void setCritical(List<String> crit) {
+ setHeader(JoseConstants.HEADER_CRITICAL, crit);
+ }
+
+ public List<String> getCritical() {
+ return
CastUtils.cast((List<?>)getHeader(JoseConstants.HEADER_CRITICAL));
+ }
+
+ public void setJsonWebKey(JsonWebKey key) {
+ setJsonWebKey(JoseConstants.HEADER_JSON_WEB_KEY, key);
+ }
+
+ public void setJsonWebKey(String headerName, JsonWebKey key) {
+ setHeader(headerName, key);
+ }
+
+ public void setJsonWebKeysUrl(String url) {
+ setHeader(JoseConstants.HEADER_JSON_WEB_KEY_SET, url);
+ }
+
+ public String getJsonWebKeysUrl() {
+ return (String)getHeader(JoseConstants.HEADER_JSON_WEB_KEY_SET);
+ }
+
+ public JsonWebKey getJsonWebKey() {
+ return getJsonWebKey(JoseConstants.HEADER_JSON_WEB_KEY);
+ }
+ public JsonWebKey getJsonWebKey(String headerName) {
+ Object jsonWebKey = getHeader(headerName);
+ if (jsonWebKey == null || jsonWebKey instanceof JsonWebKey) {
+ return (JsonWebKey)jsonWebKey;
+ }
+ Map<String, Object> map = CastUtils.cast((Map<?, ?>)jsonWebKey);
+ return new JsonWebKey(map);
+ }
+
+ public JoseHeaders setHeader(String name, Object value) {
+ setProperty(name, value);
+ return this;
+ }
+
+ public Object getHeader(String name) {
+ return getProperty(name);
+ }
+
+ public JoseHeaders setIntegerHeader(String name, Integer value) {
+ setHeader(name, value);
+ return this;
+ }
+
+ public Integer getIntegerHeader(String name) {
+ return getIntegerProperty(name);
+ }
+ public JoseHeaders setLongHeader(String name, Long value) {
+ setHeader(name, value);
+ return this;
+ }
+
+ public Long getLongHeader(String name) {
+ return getLongProperty(name);
+ }
+
+ public boolean containsHeader(String name) {
+ return containsProperty(name);
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseType.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseType.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseType.java
new file mode 100644
index 0000000..9d38332
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseType.java
@@ -0,0 +1,43 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose;
+
+
+public enum JoseType {
+ JOSE(JoseConstants.TYPE_JOSE),
+ JOSE_JSON(JoseConstants.TYPE_JOSE_JSON),
+ JWT(JoseConstants.TYPE_JWT);
+
+ private final String type;
+ private JoseType(String type) {
+ this.type = type;
+ }
+ public static JoseType getType(String type) {
+ if (type == null) {
+ return null;
+ } else if (JoseConstants.TYPE_JOSE_JSON.equals(type)) {
+ return JOSE_JSON;
+ } else {
+ return valueOf(type);
+ }
+ }
+ public String toString() {
+ return type;
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseUtils.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseUtils.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseUtils.java
new file mode 100644
index 0000000..7efaab7
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/JoseUtils.java
@@ -0,0 +1,200 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose;
+
+import java.io.File;
+import java.io.InputStream;
+import java.io.UnsupportedEncodingException;
+import java.net.URL;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Properties;
+import java.util.Set;
+import java.util.logging.Logger;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.common.classloader.ClassLoaderUtils;
+import org.apache.cxf.common.logging.LogUtils;
+import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.message.Message;
+import org.apache.cxf.phase.PhaseInterceptorChain;
+import org.apache.cxf.resource.ResourceManager;
+import org.apache.cxf.rt.security.crypto.CryptoUtils;
+
+public final class JoseUtils {
+ private static final Logger LOG = LogUtils.getL7dLogger(JoseUtils.class);
+ private static final String CLASSPATH_PREFIX = "classpath:";
+
+ private JoseUtils() {
+
+ }
+ public static String[] getCompactParts(String compactContent) {
+ if (compactContent.startsWith("\"") && compactContent.endsWith("\"")) {
+ compactContent = compactContent.substring(1,
compactContent.length() - 1);
+ }
+ return StringUtils.split(compactContent, "\\.");
+ }
+ public static void setJoseContextProperty(JoseHeaders headers) {
+ Message message = PhaseInterceptorChain.getCurrentMessage();
+ String context =
(String)message.get(JoseConstants.JOSE_CONTEXT_PROPERTY);
+ if (context != null) {
+ headers.setHeader(JoseConstants.JOSE_CONTEXT_PROPERTY, context);
+ }
+ }
+ public static void setJoseMessageContextProperty(JoseHeaders headers,
String value) {
+ headers.setHeader(JoseConstants.JOSE_CONTEXT_PROPERTY, value);
+ Message message = PhaseInterceptorChain.getCurrentMessage();
+ message.put(JoseConstants.JOSE_CONTEXT_PROPERTY, value);
+ }
+ public static void setMessageContextProperty(JoseHeaders headers) {
+ String context =
(String)headers.getHeader(JoseConstants.JOSE_CONTEXT_PROPERTY);
+ if (context != null) {
+ Message message = PhaseInterceptorChain.getCurrentMessage();
+ message.put(JoseConstants.JOSE_CONTEXT_PROPERTY, context);
+ }
+ }
+ public static void validateRequestContextProperty(JoseHeaders headers) {
+ Message message = PhaseInterceptorChain.getCurrentMessage();
+ Object requestContext =
message.get(JoseConstants.JOSE_CONTEXT_PROPERTY);
+ Object headerContext =
headers.getHeader(JoseConstants.JOSE_CONTEXT_PROPERTY);
+ if (requestContext == null && headerContext == null) {
+ return;
+ }
+ if (requestContext == null && headerContext != null
+ || requestContext != null && headerContext == null
+ || !requestContext.equals(headerContext)) {
+ LOG.warning("Invalid JOSE context property");
+ throw new JoseException();
+ }
+ }
+
+ public static String checkContentType(String contentType, String
defaultType) {
+ if (contentType != null) {
+ int paramIndex = contentType.indexOf(';');
+ String typeWithoutParams = paramIndex == -1 ? contentType :
contentType.substring(0, paramIndex);
+ if (typeWithoutParams.indexOf('/') == -1) {
+ contentType = "application/" + contentType;
+ }
+ } else {
+ contentType = defaultType;
+ }
+ return contentType;
+ }
+ public static String expandContentType(String contentType) {
+ int paramIndex = contentType.indexOf(';');
+ String typeWithoutParams = paramIndex == -1 ? contentType :
contentType.substring(0, paramIndex);
+ if (typeWithoutParams.indexOf('/') == -1) {
+ contentType = "application/" + contentType;
+ }
+ return contentType;
+ }
+
+ public static String decodeToString(String encoded) {
+ try {
+ return new String(decode(encoded), "UTF-8");
+ } catch (UnsupportedEncodingException ex) {
+ throw new JoseException(ex);
+ }
+
+ }
+ public static byte[] decode(String encoded) {
+ return CryptoUtils.decodeSequence(encoded);
+ }
+
+ public static boolean validateCriticalHeaders(JoseHeaders headers) {
+ List<String> critical = headers.getCritical();
+ if (critical == null) {
+ return true;
+ }
+ // The "crit" value MUST NOT be empty "[]" or contain either duplicate
values or "crit"
+ if (critical.isEmpty()
+ || detectDoubleEntry(critical)
+ || critical.contains(JoseConstants.HEADER_CRITICAL)) {
+ return false;
+ }
+
+ // Check that the headers contain these critical headers
+ return headers.asMap().keySet().containsAll(critical);
+ }
+ private static boolean detectDoubleEntry(List<?> list) {
+ Set<Object> inputSet = new HashSet<Object>(list);
+ return list.size() > inputSet.size();
+ }
+
+ //
+ // <Start> Copied from JAX-RS RT FRONTEND ResourceUtils
+ //
+
+ public static InputStream getResourceStream(String loc, Bus bus) throws
Exception {
+ URL url = getResourceURL(loc, bus);
+ return url == null ? null : url.openStream();
+ }
+
+ public static URL getResourceURL(String loc, Bus bus) throws Exception {
+ URL url = null;
+ if (loc.startsWith(CLASSPATH_PREFIX)) {
+ String path = loc.substring(CLASSPATH_PREFIX.length());
+ url = JoseUtils.getClasspathResourceURL(path, JoseUtils.class,
bus);
+ } else {
+ try {
+ url = new URL(loc);
+ } catch (Exception ex) {
+ // it can be either a classpath or file resource without a
scheme
+ url = JoseUtils.getClasspathResourceURL(loc, JoseUtils.class,
bus);
+ if (url == null) {
+ File file = new File(loc);
+ if (file.exists()) {
+ url = file.toURI().toURL();
+ }
+ }
+ }
+ }
+ if (url == null) {
+ LOG.warning("No resource " + loc + " is available");
+ }
+ return url;
+ }
+
+ public static URL getClasspathResourceURL(String path, Class<?>
callingClass, Bus bus) {
+ URL url = ClassLoaderUtils.getResource(path, callingClass);
+ return url == null ? getResource(path, URL.class, bus) : url;
+ }
+
+ public static <T> T getResource(String path, Class<T> resourceClass, Bus
bus) {
+ if (bus != null) {
+ ResourceManager rm = bus.getExtension(ResourceManager.class);
+ if (rm != null) {
+ return rm.resolveResource(path, resourceClass);
+ }
+ }
+ return null;
+ }
+
+ public static Properties loadProperties(String propertiesLocation, Bus
bus) throws Exception {
+ Properties props = new Properties();
+ InputStream is = getResourceStream(propertiesLocation, bus);
+ props.load(is);
+ return props;
+ }
+
+ //
+ // <End> Copied from JAX-RS RT FRONTEND ResourceUtils
+ //
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
new file mode 100644
index 0000000..8a63fa8
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
@@ -0,0 +1,390 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.rs.security.jose.common;
+
+import java.io.InputStream;
+import java.security.KeyStore;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.cert.CertPath;
+import java.security.cert.CertPathBuilder;
+import java.security.cert.CertPathBuilderResult;
+import java.security.cert.CertPathValidator;
+import java.security.cert.CertStore;
+import java.security.cert.Certificate;
+import java.security.cert.CollectionCertStoreParameters;
+import java.security.cert.PKIXBuilderParameters;
+import java.security.cert.X509CertSelector;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Enumeration;
+import java.util.List;
+import java.util.Properties;
+import java.util.logging.Logger;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.common.logging.LogUtils;
+import org.apache.cxf.common.util.PropertyUtils;
+import org.apache.cxf.message.Message;
+import org.apache.cxf.message.MessageUtils;
+import org.apache.cxf.phase.PhaseInterceptorChain;
+import org.apache.cxf.rs.security.jose.JoseException;
+import org.apache.cxf.rs.security.jose.JoseUtils;
+import org.apache.cxf.rs.security.jose.jwk.KeyOperation;
+import org.apache.cxf.rt.security.crypto.CryptoUtils;
+import org.apache.cxf.security.SecurityContext;
+
+
+/**
+ * Encryption helpers
+ */
+public final class KeyManagementUtils {
+ public static final String RSSEC_KEY_STORE_TYPE =
"rs.security.keystore.type";
+ public static final String RSSEC_KEY_STORE_PSWD =
"rs.security.keystore.password";
+ public static final String RSSEC_KEY_PSWD = "rs.security.key.password";
+ public static final String RSSEC_KEY_STORE_ALIAS =
"rs.security.keystore.alias";
+ public static final String RSSEC_KEY_STORE_ALIASES =
"rs.security.keystore.aliases";
+ public static final String RSSEC_KEY_STORE_FILE =
"rs.security.keystore.file";
+ public static final String RSSEC_PRINCIPAL_NAME =
"rs.security.principal.name";
+ public static final String RSSEC_KEY_PSWD_PROVIDER =
"rs.security.key.password.provider";
+ public static final String RSSEC_SIG_KEY_PSWD_PROVIDER =
"rs.security.signature.key.password.provider";
+ public static final String RSSEC_DECRYPT_KEY_PSWD_PROVIDER =
"rs.security.decryption.key.password.provider";
+ public static final String RSSEC_DEFAULT_ALGORITHMS =
"rs.security.default.algorithms";
+ public static final String RSSEC_REPORT_KEY_PROP =
"rs.security.report.public.key";
+ public static final String RSSEC_REPORT_KEY_ID_PROP =
"rs.security.report.public.key.id";
+ public static final String RSSEC_ACCEPT_PUBLIC_KEY_PROP =
"rs.security.accept.public.key.properties";
+ private static final Logger LOG =
LogUtils.getL7dLogger(KeyManagementUtils.class);
+
+ private KeyManagementUtils() {
+ }
+ public static List<String> loadAndEncodeX509CertificateOrChain(Message m,
Properties props) {
+ X509Certificate[] chain = loadX509CertificateOrChain(m, props);
+ return encodeX509CertificateChain(chain);
+ }
+ public static X509Certificate[] loadX509CertificateOrChain(Message m,
Properties props) {
+ KeyStore keyStore = KeyManagementUtils.loadPersistKeyStore(m, props);
+ String alias = props.getProperty(RSSEC_KEY_STORE_ALIAS);
+ return loadX509CertificateOrChain(keyStore, alias);
+ }
+ private static X509Certificate[] loadX509CertificateOrChain(KeyStore
keyStore, String alias) {
+ try {
+ Certificate[] certs = keyStore.getCertificateChain(alias);
+ if (certs != null) {
+ return Arrays.copyOf(certs, certs.length,
X509Certificate[].class);
+ } else {
+ return new
X509Certificate[]{(X509Certificate)CryptoUtils.loadCertificate(keyStore,
alias)};
+ }
+ } catch (Exception ex) {
+ LOG.warning("X509 Certificates can not be created");
+ throw new JoseException(ex);
+ }
+ }
+
+ public static PublicKey loadPublicKey(Message m, Properties props) {
+ KeyStore keyStore = KeyManagementUtils.loadPersistKeyStore(m, props);
+ return CryptoUtils.loadPublicKey(keyStore,
props.getProperty(RSSEC_KEY_STORE_ALIAS));
+ }
+ public static PublicKey loadPublicKey(Message m, String keyStoreLocProp) {
+ return loadPublicKey(m, keyStoreLocProp, null);
+ }
+ public static PublicKey loadPublicKey(Message m, String
keyStoreLocPropPreferred, String keyStoreLocPropDefault) {
+ String keyStoreLoc = getMessageProperty(m, keyStoreLocPropPreferred,
keyStoreLocPropDefault);
+ Bus bus = m.getExchange().getBus();
+ try {
+ Properties props = JoseUtils.loadProperties(keyStoreLoc, bus);
+ return KeyManagementUtils.loadPublicKey(m, props);
+ } catch (Exception ex) {
+ LOG.warning("Public key can not be loaded");
+ throw new JoseException(ex);
+ }
+ }
+ private static String getMessageProperty(Message m, String
keyStoreLocPropPreferred,
+ String keyStoreLocPropDefault) {
+ String propLoc =
+ (String)MessageUtils.getContextualProperty(m,
keyStoreLocPropPreferred, keyStoreLocPropDefault);
+ if (propLoc == null) {
+ LOG.warning("Properties resource is not identified");
+ throw new JoseException();
+ }
+ return propLoc;
+ }
+ private static PrivateKey loadPrivateKey(KeyStore keyStore,
+ Message m,
+ Properties props,
+ Bus bus,
+ PrivateKeyPasswordProvider
provider,
+ KeyOperation keyOper,
+ String alias) {
+
+ String keyPswd = props.getProperty(RSSEC_KEY_PSWD);
+ String theAlias = alias != null ? alias : getKeyId(m, props,
RSSEC_KEY_STORE_ALIAS, keyOper);
+ char[] keyPswdChars = provider != null ? provider.getPassword(props)
+ : keyPswd != null ? keyPswd.toCharArray() : null;
+ return CryptoUtils.loadPrivateKey(keyStore, keyPswdChars, theAlias);
+ }
+
+ public static PrivateKey loadPrivateKey(Message m, String keyStoreLocProp,
KeyOperation keyOper) {
+ return loadPrivateKey(m, keyStoreLocProp, null, keyOper);
+ }
+ public static PrivateKey loadPrivateKey(Message m, String
keyStoreLocPropPreferred,
+ String keyStoreLocPropDefault,
KeyOperation keyOper) {
+ String keyStoreLoc = getMessageProperty(m, keyStoreLocPropPreferred,
keyStoreLocPropDefault);
+ Bus bus = m.getExchange().getBus();
+ try {
+ Properties props = JoseUtils.loadProperties(keyStoreLoc, bus);
+ return loadPrivateKey(m, props, keyOper);
+ } catch (Exception ex) {
+ throw new SecurityException(ex);
+ }
+ }
+
+ public static String getKeyId(Message m, Properties props,
+ String preferredPropertyName,
+ KeyOperation keyOper) {
+ String kid = null;
+ String altPropertyName = null;
+ if (keyOper != null) {
+ if (keyOper == KeyOperation.ENCRYPT || keyOper ==
KeyOperation.DECRYPT) {
+ altPropertyName = preferredPropertyName + ".jwe";
+ } else if (keyOper == KeyOperation.SIGN || keyOper ==
KeyOperation.VERIFY) {
+ altPropertyName = preferredPropertyName + ".jws";
+ }
+ String direction = m.getExchange().getOutMessage() == m ? ".out" :
".in";
+ kid = (String)MessageUtils.getContextualProperty(m,
preferredPropertyName, altPropertyName + direction);
+ // Check whether the direction is not set for the altPropertyName
+ if (kid == null && altPropertyName != null) {
+ kid = (String)m.getContextualProperty(altPropertyName);
+ }
+ }
+
+ if (kid == null) {
+ kid = props.getProperty(preferredPropertyName);
+ }
+ if (kid == null && altPropertyName != null) {
+ kid = props.getProperty(altPropertyName);
+ }
+ return kid;
+ }
+ public static PrivateKeyPasswordProvider loadPasswordProvider(Message m,
Properties props, KeyOperation keyOper) {
+ PrivateKeyPasswordProvider cb =
+
(PrivateKeyPasswordProvider)m.getContextualProperty(RSSEC_KEY_PSWD_PROVIDER);
+ if (cb == null && keyOper != null) {
+ String propName = keyOper == KeyOperation.SIGN ?
RSSEC_SIG_KEY_PSWD_PROVIDER
+ : keyOper == KeyOperation.DECRYPT
+ ? RSSEC_DECRYPT_KEY_PSWD_PROVIDER : null;
+ if (propName != null) {
+ cb =
(PrivateKeyPasswordProvider)m.getContextualProperty(propName);
+ }
+ }
+ return cb;
+ }
+
+ public static PrivateKey loadPrivateKey(Message m, Properties props,
KeyOperation keyOper) {
+ KeyStore keyStore = loadPersistKeyStore(m, props);
+ return loadPrivateKey(keyStore, m, props, keyOper, null);
+ }
+ private static PrivateKey loadPrivateKey(KeyStore keyStore, Message m,
Properties props, KeyOperation keyOper,
+ String alias) {
+ Bus bus = m.getExchange().getBus();
+ PrivateKeyPasswordProvider cb = loadPasswordProvider(m, props,
keyOper);
+ if (cb != null && m.getExchange().getInMessage() != null) {
+ SecurityContext sc =
m.getExchange().getInMessage().get(SecurityContext.class);
+ if (sc != null) {
+ Principal p = sc.getUserPrincipal();
+ if (p != null) {
+ props.setProperty(RSSEC_PRINCIPAL_NAME, p.getName());
+ }
+ }
+ }
+ return loadPrivateKey(keyStore, m, props, bus, cb, keyOper, alias);
+ }
+ public static KeyStore loadPersistKeyStore(Message m, Properties props) {
+ if (!props.containsKey(RSSEC_KEY_STORE_FILE)) {
+ LOG.warning("No keystore file has been configured");
+ throw new JoseException("No keystore file has been configured");
+ }
+ KeyStore keyStore =
(KeyStore)m.getExchange().get(props.get(RSSEC_KEY_STORE_FILE));
+ if (keyStore == null) {
+ keyStore = loadKeyStore(props, m.getExchange().getBus());
+ m.getExchange().put((String)props.get(RSSEC_KEY_STORE_FILE),
keyStore);
+ }
+ return keyStore;
+ }
+ public static KeyStore loadKeyStore(Properties props, Bus bus) {
+ String keyStoreType = props.getProperty(RSSEC_KEY_STORE_TYPE);
+ String keyStoreLoc = props.getProperty(RSSEC_KEY_STORE_FILE);
+ String keyStorePswd = props.getProperty(RSSEC_KEY_STORE_PSWD);
+
+ if (keyStorePswd == null) {
+ throw new JoseException("No keystore password was defined");
+ }
+ try {
+ InputStream is = JoseUtils.getResourceStream(keyStoreLoc, bus);
+ return CryptoUtils.loadKeyStore(is, keyStorePswd.toCharArray(),
keyStoreType);
+ } catch (Exception ex) {
+ LOG.warning("Key store can not be loaded");
+ throw new JoseException(ex);
+ }
+ }
+ public static List<String> encodeX509CertificateChain(X509Certificate[]
chain) {
+ return encodeX509CertificateChain(Arrays.asList(chain));
+ }
+ public static List<String>
encodeX509CertificateChain(List<X509Certificate> chain) {
+ List<String> encodedChain = new ArrayList<String>(chain.size());
+ for (X509Certificate cert : chain) {
+ try {
+ encodedChain.add(CryptoUtils.encodeCertificate(cert));
+ } catch (Exception ex) {
+ LOG.warning("X509 Certificate can not be encoded");
+ throw new JoseException(ex);
+ }
+ }
+ return encodedChain;
+ }
+ public static List<X509Certificate> toX509CertificateChain(List<String>
base64EncodedChain) {
+ if (base64EncodedChain != null) {
+ List<X509Certificate> certs = new
ArrayList<X509Certificate>(base64EncodedChain.size());
+ for (String encodedCert : base64EncodedChain) {
+ try {
+
certs.add((X509Certificate)CryptoUtils.decodeCertificate(encodedCert));
+ } catch (Exception ex) {
+ LOG.warning("X509 Certificate can not be decoded");
+ throw new JoseException(ex);
+ }
+ }
+ return certs;
+ } else {
+ return null;
+ }
+ }
+ //TODO: enhance the certificate validation code
+ public static void validateCertificateChain(Properties storeProperties,
List<X509Certificate> inCerts) {
+ Message message = PhaseInterceptorChain.getCurrentMessage();
+ KeyStore ks = loadPersistKeyStore(message, storeProperties);
+ validateCertificateChain(ks, inCerts);
+ }
+ public static void validateCertificateChain(KeyStore ks,
List<X509Certificate> inCerts) {
+ // Initial chain validation, to be enhanced as needed
+ try {
+ X509CertSelector certSelect = new X509CertSelector();
+ certSelect.setCertificate((X509Certificate) inCerts.get(0));
+ PKIXBuilderParameters pbParams = new PKIXBuilderParameters(ks,
certSelect);
+ pbParams.addCertStore(CertStore.getInstance("Collection",
+ new
CollectionCertStoreParameters(inCerts)));
+ pbParams.setMaxPathLength(-1);
+ pbParams.setRevocationEnabled(false);
+ CertPathBuilderResult buildResult =
CertPathBuilder.getInstance("PKIX").build(pbParams);
+ CertPath certPath = buildResult.getCertPath();
+ CertPathValidator.getInstance("PKIX").validate(certPath, pbParams);
+ } catch (Exception ex) {
+ LOG.warning("Certificate path validation error");
+ throw new JoseException(ex);
+ }
+ }
+ public static X509Certificate[] toX509CertificateChainArray(List<String>
base64EncodedChain) {
+ List<X509Certificate> chain =
toX509CertificateChain(base64EncodedChain);
+ return chain == null ? null : chain.toArray(new X509Certificate[]{});
+ }
+ public static String getKeyAlgorithm(Message m, Properties props, String
propName, String defaultAlg) {
+ String algo = props.getProperty(propName);
+ if (algo == null) {
+ algo = (String)m.getContextualProperty(propName);
+ }
+ if (algo == null &&
PropertyUtils.isTrue(m.getContextualProperty(RSSEC_DEFAULT_ALGORITHMS))) {
+ algo = defaultAlg;
+ }
+ return algo;
+ }
+
+ public static Properties loadStoreProperties(Message m, boolean required,
+ String storeProp1, String
storeProp2) {
+ if (m == null) {
+ if (required) {
+ throw new JoseException();
+ }
+ return null;
+ }
+ Properties props = null;
+ String propLoc =
+ (String)MessageUtils.getContextualProperty(m, storeProp1,
storeProp2);
+ if (propLoc != null) {
+ try {
+ props = JoseUtils.loadProperties(propLoc,
m.getExchange().getBus());
+ } catch (Exception ex) {
+ LOG.warning("Properties resource is not identified");
+ throw new JoseException(ex);
+ }
+ } else {
+ String keyFile =
(String)m.getContextualProperty(RSSEC_KEY_STORE_FILE);
+ if (keyFile != null) {
+ props = new Properties();
+ props.setProperty(RSSEC_KEY_STORE_FILE, keyFile);
+ String type =
(String)m.getContextualProperty(RSSEC_KEY_STORE_TYPE);
+ if (type == null) {
+ type = "jwk";
+ }
+ props.setProperty(RSSEC_KEY_STORE_TYPE, type);
+ String alias =
(String)m.getContextualProperty(RSSEC_KEY_STORE_ALIAS);
+ if (alias != null) {
+ props.setProperty(RSSEC_KEY_STORE_ALIAS, alias);
+ }
+ String keystorePassword =
(String)m.getContextualProperty(RSSEC_KEY_STORE_PSWD);
+ if (keystorePassword != null) {
+ props.setProperty(RSSEC_KEY_STORE_PSWD, keystorePassword);
+ }
+ String keyPassword =
(String)m.getContextualProperty(RSSEC_KEY_PSWD);
+ if (keyPassword != null) {
+ props.setProperty(RSSEC_KEY_PSWD, keyPassword);
+ }
+ }
+ }
+ if (props == null && required) {
+ LOG.warning("Properties resource is not identified");
+ throw new JoseException();
+ }
+ return props;
+ }
+ public static PrivateKey loadPrivateKey(Message m, Properties props,
+ List<X509Certificate> inCerts,
+ KeyOperation keyOper) {
+ KeyStore ks = loadPersistKeyStore(m, props);
+
+ try {
+ String alias = ks.getCertificateAlias(inCerts.get(0));
+ if (alias != null) {
+ for (Enumeration<String> e = ks.aliases();
e.hasMoreElements();) {
+ String currentAlias = e.nextElement();
+ X509Certificate[] currentCertArray =
loadX509CertificateOrChain(ks, currentAlias);
+ if (currentCertArray != null) {
+ alias = currentAlias;
+ break;
+ }
+ }
+ }
+ return loadPrivateKey(ks, m, props, keyOper, alias);
+
+ } catch (Exception ex) {
+ LOG.warning("Private key can not be loaded");
+ throw new JoseException(ex);
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java
new file mode 100644
index 0000000..fc58ee5
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java
@@ -0,0 +1,25 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.jose.common;
+
+import java.util.Properties;
+
+public interface PrivateKeyPasswordProvider {
+ char[] getPassword(Properties storeProperties);
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/AlgorithmUtils.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/AlgorithmUtils.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/AlgorithmUtils.java
new file mode 100644
index 0000000..76854ca
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/AlgorithmUtils.java
@@ -0,0 +1,271 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.rs.security.jose.jwa;
+
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+
+
+
+public final class AlgorithmUtils {
+ public static final String AES = "AES";
+
+ // Key Encryption
+ // JWA
+ public static final String RSA_OAEP_ALGO = "RSA-OAEP";
+ public static final String RSA_OAEP_256_ALGO = "RSA-OAEP-256";
+ public static final String RSA1_5_ALGO = "RSA1_5";
+ public static final String A128KW_ALGO = "A128KW";
+ public static final String A192KW_ALGO = "A192KW";
+ public static final String A256KW_ALGO = "A256KW";
+ public static final String A128GCMKW_ALGO = "A128GCMKW";
+ public static final String A192GCMKW_ALGO = "A192GCMKW";
+ public static final String A256GCMKW_ALGO = "A256GCMKW";
+ public static final String ECDH_ES_A128KW_ALGO = "ECDH-ES+A128KW";
+ public static final String ECDH_ES_A192KW_ALGO = "ECDH-ES+A192KW";
+ public static final String ECDH_ES_A256KW_ALGO = "ECDH-ES+A256KW";
+ public static final String PBES2_HS256_A128KW_ALGO = "PBES2-HS256+A128KW";
+ public static final String PBES2_HS384_A192KW_ALGO = "PBES2-HS384+A192KW";
+ public static final String PBES2_HS512_A256KW_ALGO = "PBES2-HS512+A256KW";
+ public static final String ECDH_ES_DIRECT_ALGO = "ECDH-ES";
+ // Java
+ public static final String RSA_OAEP_ALGO_JAVA =
"RSA/ECB/OAEPWithSHA-1AndMGF1Padding";
+ public static final String RSA_OAEP_256_ALGO_JAVA =
"RSA/ECB/OAEPWithSHA-256AndMGF1Padding";
+ public static final String RSA_1_5_ALGO_JAVA = "RSA/ECB/PKCS1Padding";
+ public static final String AES_WRAP_ALGO_JAVA = AES + "Wrap";
+ // Content Encryption
+ // JWA
+ public static final String A128CBC_HS256_ALGO = "A128CBC-HS256";
+ public static final String A192CBC_HS384_ALGO = "A192CBC-HS384";
+ public static final String A256CBC_HS512_ALGO = "A256CBC-HS512";
+ public static final String A128GCM_ALGO = "A128GCM";
+ public static final String A192GCM_ALGO = "A192GCM";
+ public static final String A256GCM_ALGO = "A256GCM";
+ // Java
+ public static final String AES_GCM_ALGO_JAVA = AES + "/GCM/NoPadding";
+ public static final String AES_CBC_ALGO_JAVA = AES + "/CBC/PKCS7Padding";
+ // Signature
+ // JWA
+ public static final String HMAC_SHA_256_ALGO = "HS256";
+ public static final String HMAC_SHA_384_ALGO = "HS384";
+ public static final String HMAC_SHA_512_ALGO = "HS512";
+ public static final String RS_SHA_256_ALGO = "RS256";
+ public static final String RS_SHA_384_ALGO = "RS384";
+ public static final String RS_SHA_512_ALGO = "RS512";
+ public static final String PS_SHA_256_ALGO = "PS256";
+ public static final String PS_SHA_384_ALGO = "PS384";
+ public static final String PS_SHA_512_ALGO = "PS512";
+ public static final String ES_SHA_256_ALGO = "ES256";
+ public static final String ES_SHA_384_ALGO = "ES384";
+ public static final String ES_SHA_512_ALGO = "ES512";
+ public static final String NONE_TEXT_ALGO = "none";
+ // Java
+ public static final String HMAC_SHA_256_JAVA = "HmacSHA256";
+ public static final String HMAC_SHA_384_JAVA = "HmacSHA384";
+ public static final String HMAC_SHA_512_JAVA = "HmacSHA512";
+ public static final String RS_SHA_256_JAVA = "SHA256withRSA";
+ public static final String RS_SHA_384_JAVA = "SHA384withRSA";
+ public static final String RS_SHA_512_JAVA = "SHA512withRSA";
+ public static final String PS_SHA_256_JAVA = "SHA256withRSAandMGF1";
+ public static final String PS_SHA_384_JAVA = "SHA384withRSAandMGF1";
+ public static final String PS_SHA_512_JAVA = "SHA512withRSAandMGF1";
+ public static final String ES_SHA_256_JAVA = "SHA256withECDSA";
+ public static final String ES_SHA_384_JAVA = "SHA384withECDSA";
+ public static final String ES_SHA_512_JAVA = "SHA512withECDSA";
+
+ public static final Set<String> HMAC_SIGN_SET = new
HashSet<String>(Arrays.asList(HMAC_SHA_256_ALGO,
+
HMAC_SHA_384_ALGO,
+
HMAC_SHA_512_ALGO));
+ public static final Set<String> RSA_SHA_SIGN_SET = new
HashSet<String>(Arrays.asList(RS_SHA_256_ALGO,
+
RS_SHA_384_ALGO,
+
RS_SHA_512_ALGO));
+ public static final Set<String> RSA_SHA_PS_SIGN_SET = new
HashSet<String>(Arrays.asList(PS_SHA_256_ALGO,
+ PS_SHA_384_ALGO,
+ PS_SHA_512_ALGO));
+ public static final Set<String> EC_SHA_SIGN_SET = new
HashSet<String>(Arrays.asList(ES_SHA_256_ALGO,
+
ES_SHA_384_ALGO,
+
ES_SHA_512_ALGO));
+ public static final Set<String> RSA_CEK_SET = new
HashSet<String>(Arrays.asList(RSA_OAEP_ALGO,
+
RSA_OAEP_256_ALGO,
+
RSA1_5_ALGO));
+ public static final Set<String> AES_GCM_CEK_SET = new
HashSet<String>(Arrays.asList(A128GCM_ALGO,
+
A192GCM_ALGO,
+
A256GCM_ALGO));
+ public static final Set<String> AES_GCM_KW_SET = new
HashSet<String>(Arrays.asList(A128GCMKW_ALGO,
+
A192GCMKW_ALGO,
+
A256GCMKW_ALGO));
+ public static final Set<String> AES_KW_SET = new
HashSet<String>(Arrays.asList(A128KW_ALGO,
+
A192KW_ALGO,
+
A256KW_ALGO));
+ public static final Set<String> ACBC_HS_SET = new
HashSet<String>(Arrays.asList(A128CBC_HS256_ALGO,
+ A192CBC_HS384_ALGO,
+ A256CBC_HS512_ALGO));
+ public static final Set<String> PBES_HS_SET = new
HashSet<String>(Arrays.asList(PBES2_HS256_A128KW_ALGO,
+ PBES2_HS384_A192KW_ALGO,
+ PBES2_HS512_A256KW_ALGO));
+ public static final Set<String> ECDH_ES_WRAP_SET = new
HashSet<String>(Arrays.asList(ECDH_ES_A128KW_ALGO,
+ ECDH_ES_A192KW_ALGO,
+ ECDH_ES_A256KW_ALGO));
+
+ private static final Map<String, String> JAVA_TO_JWA_NAMES;
+ private static final Map<String, String> JWA_TO_JAVA_NAMES;
+ static {
+ JAVA_TO_JWA_NAMES = new HashMap<String, String>();
+ JAVA_TO_JWA_NAMES.put(HMAC_SHA_256_JAVA, HMAC_SHA_256_ALGO);
+ JAVA_TO_JWA_NAMES.put(HMAC_SHA_384_JAVA, HMAC_SHA_384_ALGO);
+ JAVA_TO_JWA_NAMES.put(HMAC_SHA_512_JAVA, HMAC_SHA_512_ALGO);
+ JAVA_TO_JWA_NAMES.put(RS_SHA_256_JAVA, RS_SHA_256_ALGO);
+ JAVA_TO_JWA_NAMES.put(RS_SHA_384_JAVA, RS_SHA_384_ALGO);
+ JAVA_TO_JWA_NAMES.put(RS_SHA_512_JAVA, RS_SHA_512_ALGO);
+ JAVA_TO_JWA_NAMES.put(PS_SHA_256_JAVA, PS_SHA_256_ALGO);
+ JAVA_TO_JWA_NAMES.put(PS_SHA_384_JAVA, PS_SHA_384_ALGO);
+ JAVA_TO_JWA_NAMES.put(PS_SHA_512_JAVA, PS_SHA_512_ALGO);
+ JAVA_TO_JWA_NAMES.put(ES_SHA_256_JAVA, ES_SHA_256_ALGO);
+ JAVA_TO_JWA_NAMES.put(ES_SHA_384_JAVA, ES_SHA_384_ALGO);
+ JAVA_TO_JWA_NAMES.put(ES_SHA_512_JAVA, ES_SHA_512_ALGO);
+ JAVA_TO_JWA_NAMES.put(RSA_OAEP_ALGO_JAVA, RSA_OAEP_ALGO);
+ JAVA_TO_JWA_NAMES.put(RSA_OAEP_256_ALGO_JAVA, RSA_OAEP_256_ALGO);
+ JAVA_TO_JWA_NAMES.put(RSA_1_5_ALGO_JAVA, RSA1_5_ALGO);
+ JAVA_TO_JWA_NAMES.put(AES_GCM_ALGO_JAVA, A256GCM_ALGO);
+ JAVA_TO_JWA_NAMES.put(AES_GCM_ALGO_JAVA, A192GCM_ALGO);
+ JAVA_TO_JWA_NAMES.put(AES_GCM_ALGO_JAVA, A128GCM_ALGO);
+ JAVA_TO_JWA_NAMES.put(AES_WRAP_ALGO_JAVA, A128KW_ALGO);
+ JAVA_TO_JWA_NAMES.put(AES_WRAP_ALGO_JAVA, A192KW_ALGO);
+ JAVA_TO_JWA_NAMES.put(AES_WRAP_ALGO_JAVA, A256KW_ALGO);
+ JAVA_TO_JWA_NAMES.put(AES_CBC_ALGO_JAVA, A128CBC_HS256_ALGO);
+ JAVA_TO_JWA_NAMES.put(AES_CBC_ALGO_JAVA, A192CBC_HS384_ALGO);
+ JAVA_TO_JWA_NAMES.put(AES_CBC_ALGO_JAVA, A256CBC_HS512_ALGO);
+ JWA_TO_JAVA_NAMES = new HashMap<String, String>();
+ JWA_TO_JAVA_NAMES.put(HMAC_SHA_256_ALGO, HMAC_SHA_256_JAVA);
+ JWA_TO_JAVA_NAMES.put(HMAC_SHA_384_ALGO, HMAC_SHA_384_JAVA);
+ JWA_TO_JAVA_NAMES.put(HMAC_SHA_512_ALGO, HMAC_SHA_512_JAVA);
+ JWA_TO_JAVA_NAMES.put(RS_SHA_256_ALGO, RS_SHA_256_JAVA);
+ JWA_TO_JAVA_NAMES.put(RS_SHA_384_ALGO, RS_SHA_384_JAVA);
+ JWA_TO_JAVA_NAMES.put(RS_SHA_512_ALGO, RS_SHA_512_JAVA);
+ JWA_TO_JAVA_NAMES.put(PS_SHA_256_ALGO, PS_SHA_256_JAVA);
+ JWA_TO_JAVA_NAMES.put(PS_SHA_384_ALGO, PS_SHA_384_JAVA);
+ JWA_TO_JAVA_NAMES.put(PS_SHA_512_ALGO, PS_SHA_512_JAVA);
+ JWA_TO_JAVA_NAMES.put(ES_SHA_256_ALGO, ES_SHA_256_JAVA);
+ JWA_TO_JAVA_NAMES.put(ES_SHA_384_ALGO, ES_SHA_384_JAVA);
+ JWA_TO_JAVA_NAMES.put(ES_SHA_512_ALGO, ES_SHA_512_JAVA);
+ JWA_TO_JAVA_NAMES.put(RSA_OAEP_ALGO, RSA_OAEP_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(RSA_OAEP_256_ALGO, RSA_OAEP_256_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(RSA1_5_ALGO, RSA_1_5_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A128KW_ALGO, AES_WRAP_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A192KW_ALGO, AES_WRAP_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A256KW_ALGO, AES_WRAP_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A256GCM_ALGO, AES_GCM_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A192GCM_ALGO, AES_GCM_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A128GCM_ALGO, AES_GCM_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A256GCMKW_ALGO, AES_GCM_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A192GCMKW_ALGO, AES_GCM_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A128GCMKW_ALGO, AES_GCM_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A128CBC_HS256_ALGO, AES_CBC_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A192CBC_HS384_ALGO, AES_CBC_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(A256CBC_HS512_ALGO, AES_CBC_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(PBES2_HS256_A128KW_ALGO, AES_WRAP_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(PBES2_HS384_A192KW_ALGO, AES_WRAP_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(PBES2_HS512_A256KW_ALGO, AES_WRAP_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(ECDH_ES_A128KW_ALGO, AES_WRAP_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(ECDH_ES_A192KW_ALGO, AES_WRAP_ALGO_JAVA);
+ JWA_TO_JAVA_NAMES.put(ECDH_ES_A256KW_ALGO, AES_WRAP_ALGO_JAVA);
+ }
+
+ private AlgorithmUtils() {
+ }
+ public static boolean isRsa(String algo) {
+ return isRsaKeyWrap(algo) || isRsaSign(algo);
+ }
+ public static boolean isRsaKeyWrap(String algo) {
+ return RSA_CEK_SET.contains(algo);
+ }
+ public static boolean isAesKeyWrap(String algo) {
+ return AES_KW_SET.contains(algo);
+ }
+ public static boolean isAesGcmKeyWrap(String algo) {
+ return AES_GCM_KW_SET.contains(algo);
+ }
+ public static boolean isPbesHsWrap(String algo) {
+ return PBES_HS_SET.contains(algo);
+ }
+ public static boolean isEcdhEsWrap(String algo) {
+ return ECDH_ES_WRAP_SET.contains(algo);
+ }
+ public static boolean isEcdhEsDirect(String algo) {
+ return ECDH_ES_DIRECT_ALGO.equals(algo);
+ }
+ public static boolean isAesGcm(String algo) {
+ return AES_GCM_CEK_SET.contains(algo);
+ }
+ public static boolean isAesCbcHmac(String algo) {
+ return ACBC_HS_SET.contains(algo);
+ }
+ public static boolean isHmacSign(String algo) {
+ return HMAC_SIGN_SET.contains(algo);
+ }
+ public static boolean isOctet(String algo) {
+ return isHmacSign(algo)
+ || isAesCbcHmac(algo)
+ || isAesGcm(algo)
+ || isAesGcmKeyWrap(algo)
+ || isAesKeyWrap(algo);
+ }
+ public static boolean isRsaSign(String algo) {
+ return isRsaShaSign(algo) || isRsaShaPsSign(algo);
+ }
+ public static boolean isRsaShaSign(String algo) {
+ return RSA_SHA_SIGN_SET.contains(algo);
+ }
+ public static boolean isRsaShaPsSign(String algo) {
+ return RSA_SHA_PS_SIGN_SET.contains(algo);
+ }
+ public static boolean isEcDsaSign(String algo) {
+ return EC_SHA_SIGN_SET.contains(algo);
+ }
+
+ public static String toJwaName(String javaName, int keyBitSize) {
+ //TODO: perhaps a key should be a name+keysize pair
+ String name = JAVA_TO_JWA_NAMES.get(javaName);
+ if (name == null && javaName.startsWith(AES)) {
+ name = "A" + keyBitSize + "GCM";
+ }
+ return name;
+ }
+ public static String toJavaName(String jwtName) {
+ return JWA_TO_JAVA_NAMES.get(jwtName);
+ }
+ public static String toJavaAlgoNameOnly(String jwtName) {
+ return stripAlgoProperties(toJavaName(jwtName));
+ }
+ public static String stripAlgoProperties(String javaName) {
+ if (javaName != null) {
+ int index = javaName.indexOf('/');
+ if (index != -1) {
+ javaName = javaName.substring(0, index);
+ }
+ }
+ return javaName;
+ }
+
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/cxf/blob/5e40ea35/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/ContentAlgorithm.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/ContentAlgorithm.java
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/ContentAlgorithm.java
new file mode 100644
index 0000000..1a8b9bc
--- /dev/null
+++
b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/ContentAlgorithm.java
@@ -0,0 +1,70 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.rs.security.jose.jwa;
+
+
+
+
+public enum ContentAlgorithm {
+ A128GCM(AlgorithmUtils.A128GCM_ALGO, "AES/GCM/NoPadding", 128),
+ A192GCM(AlgorithmUtils.A192GCM_ALGO, "AES/GCM/NoPadding", 192),
+ A256GCM(AlgorithmUtils.A256GCM_ALGO, "AES/GCM/NoPadding", 256),
+ //TODO: default to "AES/CBC/PKCS5Padding" if Cipher "AES/CBC/PKCS7Padding"
+ // can not be initialized, apparently Java 8 has decided to settle on
PKCS5Padding only
+ A128CBC_HS256(AlgorithmUtils.A128CBC_HS256_ALGO, "AES/CBC/PKCS7Padding",
128),
+ A192CBC_HS384(AlgorithmUtils.A192CBC_HS384_ALGO, "AES/CBC/PKCS7Padding",
192),
+ A256CBC_HS512(AlgorithmUtils.A256CBC_HS512_ALGO, "AES/CBC/PKCS7Padding",
256);
+
+ private final String jwaName;
+ private final String javaName;
+ private final int keySizeBits;
+
+ private ContentAlgorithm(String jwaName, String javaName, int keySizeBits)
{
+ this.jwaName = jwaName;
+ this.javaName = javaName;
+ this.keySizeBits = keySizeBits;
+ }
+
+ public String getJwaName() {
+ return jwaName;
+ }
+
+ public String getJavaName() {
+ return javaName == null ? name() : javaName;
+ }
+
+ public String getJavaAlgoName() {
+ return AlgorithmUtils.stripAlgoProperties(getJavaName());
+ }
+
+ public int getKeySizeBits() {
+ return keySizeBits;
+ }
+
+ public static ContentAlgorithm getAlgorithm(String algo) {
+ if (algo == null) {
+ return null;
+ }
+ return ContentAlgorithm.valueOf(algo.replace('-', '_')
+ .replace('+', '_'));
+
+ }
+
+}
\ No newline at end of file
