> On May 7, 2019, at 4:25 PM, Jean-Louis Monteiro <[email protected]> > wrote: > > Good, and happy to wait if you volunteer for the M3 release lol > > Added a quick note this morning regarding this renaming > signerKeys could have become signingKeys or something else. > But using publicKeys with Key being an abstraction for a secret key or a > public/private key, I'm not sure it's accurate. > Either you change the Key type to a subclass which is more specialized. Or we > keep a more generic name.
MP-JWT only supports publicKey and the property has "publicKey" in it, but we definitely could support hmac signatures. I *barely* got started with moving to the term "verificationKey" as that's the only catch-all phrase. I ended up getting distracted on the plane over to Tokyo and hacking up a concept that allows bean validation to be used to validate an MP JsonWebToken instance. It needs to get wired into an interceptor so it can actually be used, but here's the concept: - the bean method has bean validation annotations https://github.com/dblevins/tomee/blob/jwtimprovements/mp-jwt/src/test/java/org/apache/tomee/microprofile/jwt/bval/data/Shapes.java#L25 - the bean validation constraint can validate some part of the JsonWebToken https://github.com/dblevins/tomee/blob/jwtimprovements/mp-jwt/src/test/java/org/apache/tomee/microprofile/jwt/bval/ann/Audience.java#L61 - a future interceptor calls this and can get a validation result https://github.com/dblevins/tomee/blob/jwtimprovements/mp-jwt/src/test/java/org/apache/tomee/microprofile/jwt/bval/ValidationConstraintsTest.java#L50 https://github.com/dblevins/tomee/blob/jwtimprovements/mp-jwt/src/test/java/org/apache/tomee/microprofile/jwt/bval/ValidationConstraintsTest.java#L68 https://github.com/dblevins/tomee/blob/jwtimprovements/mp-jwt/src/test/java/org/apache/tomee/microprofile/jwt/bval/ValidationConstraintsTest.java#L72 I forget what the magic code is to programmatically add an interceptor via CDI. If anyone has that handy, that'd be great. -David
