-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #21 from adorsys/20-account-for-clock-skew
Run time comparisons taking account of possible clock skew
- Loading branch information
Showing
12 changed files
with
361 additions
and
218 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| name: CI | ||
|
|
||
| on: [pull_request] | ||
|
|
||
| jobs: | ||
| build: | ||
| name: Build (and Test) | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up JDK 17 | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| distribution: 'temurin' | ||
| java-version: '17' | ||
|
|
||
| - name: Build with Maven | ||
| run: ./mvnw clean package |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,75 +7,41 @@ | |
| * | ||
| * @author <a href="mailto:[email protected]">Ingrid Kamga</a> | ||
| */ | ||
| public class IssuerSignedJwtVerificationOpts { | ||
| public class IssuerSignedJwtVerificationOpts extends TimeClaimVerificationOpts { | ||
|
|
||
| private final JWSVerifier verifier; | ||
| private final boolean validateIssuedAtClaim; | ||
| private final boolean validateExpirationClaim; | ||
| private final boolean validateNotBeforeClaim; | ||
|
|
||
| public IssuerSignedJwtVerificationOpts( | ||
| JWSVerifier verifier, | ||
| boolean validateIssuedAtClaim, | ||
| boolean validateExpirationClaim, | ||
| boolean validateNotBeforeClaim) { | ||
| boolean validateNotBeforeClaim, | ||
| int leewaySeconds) { | ||
| super(validateExpirationClaim, validateNotBeforeClaim, leewaySeconds); | ||
| this.verifier = verifier; | ||
| this.validateIssuedAtClaim = validateIssuedAtClaim; | ||
| this.validateExpirationClaim = validateExpirationClaim; | ||
| this.validateNotBeforeClaim = validateNotBeforeClaim; | ||
| } | ||
|
|
||
| public JWSVerifier getVerifier() { | ||
| return verifier; | ||
| } | ||
|
|
||
| public boolean mustValidateIssuedAtClaim() { | ||
| return validateIssuedAtClaim; | ||
| } | ||
|
|
||
| public boolean mustValidateExpirationClaim() { | ||
| return validateExpirationClaim; | ||
| } | ||
|
|
||
| public boolean mustValidateNotBeforeClaim() { | ||
| return validateNotBeforeClaim; | ||
| } | ||
|
|
||
| public static IssuerSignedJwtVerificationOpts.Builder builder() { | ||
| return new IssuerSignedJwtVerificationOpts.Builder(); | ||
| public static Builder builder() { | ||
| return new Builder(); | ||
| } | ||
|
|
||
| public static class Builder { | ||
| public static class Builder extends TimeClaimVerificationOpts.Builder<Builder> { | ||
| private JWSVerifier verifier; | ||
| private boolean validateIssuedAtClaim; | ||
| private boolean validateExpirationClaim = true; | ||
| private boolean validateNotBeforeClaim = true; | ||
|
|
||
| public Builder withVerifier(JWSVerifier verifier) { | ||
| this.verifier = verifier; | ||
| return this; | ||
| } | ||
|
|
||
| public Builder withValidateIssuedAtClaim(boolean validateIssuedAtClaim) { | ||
| this.validateIssuedAtClaim = validateIssuedAtClaim; | ||
| return this; | ||
| } | ||
|
|
||
| public Builder withValidateExpirationClaim(boolean validateExpirationClaim) { | ||
| this.validateExpirationClaim = validateExpirationClaim; | ||
| return this; | ||
| } | ||
|
|
||
| public Builder withValidateNotBeforeClaim(boolean validateNotBeforeClaim) { | ||
| this.validateNotBeforeClaim = validateNotBeforeClaim; | ||
| return this; | ||
| } | ||
|
|
||
| public IssuerSignedJwtVerificationOpts build() { | ||
| return new IssuerSignedJwtVerificationOpts( | ||
| verifier, | ||
| validateIssuedAtClaim, | ||
| validateExpirationClaim, | ||
| validateNotBeforeClaim | ||
| validateNotBeforeClaim, | ||
| leewaySeconds | ||
| ); | ||
| } | ||
| } | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
76 changes: 76 additions & 0 deletions
76
src/main/java/de/adorsys/sdjwt/TimeClaimVerificationOpts.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| package de.adorsys.sdjwt; | ||
|
|
||
| /** | ||
| * Options for validating common time claims during SD-JWT verification. | ||
| * | ||
| * @author <a href="mailto:[email protected]">Ingrid Kamga</a> | ||
| */ | ||
| public class TimeClaimVerificationOpts { | ||
|
|
||
| /** | ||
| * Tolerance window to account for clock skew when checking time claims | ||
| */ | ||
| public static final int DEFAULT_LEEWAY_SECONDS = 10; | ||
|
|
||
| private final boolean validateExpirationClaim; | ||
| private final boolean validateNotBeforeClaim; | ||
| private final int leewaySeconds; | ||
|
|
||
| public TimeClaimVerificationOpts( | ||
| boolean validateExpirationClaim, | ||
| boolean validateNotBeforeClaim, | ||
| int leewaySeconds) { | ||
| this.validateExpirationClaim = validateExpirationClaim; | ||
| this.validateNotBeforeClaim = validateNotBeforeClaim; | ||
| this.leewaySeconds = leewaySeconds; | ||
| } | ||
|
|
||
| public boolean mustValidateExpirationClaim() { | ||
| return validateExpirationClaim; | ||
| } | ||
|
|
||
| public boolean mustValidateNotBeforeClaim() { | ||
| return validateNotBeforeClaim; | ||
| } | ||
|
|
||
| public int getLeewaySeconds() { | ||
| return leewaySeconds; | ||
| } | ||
|
|
||
| public static <T extends Builder<T>> Builder<T> builder() { | ||
| return new Builder<>(); | ||
| } | ||
|
|
||
| public static class Builder<T extends Builder<T>> { | ||
|
|
||
| protected boolean validateExpirationClaim = true; | ||
| protected boolean validateNotBeforeClaim = true; | ||
| protected int leewaySeconds = DEFAULT_LEEWAY_SECONDS; | ||
|
|
||
| @SuppressWarnings("unchecked") | ||
| public T withValidateExpirationClaim(boolean validateExpirationClaim) { | ||
| this.validateExpirationClaim = validateExpirationClaim; | ||
| return (T) this; | ||
| } | ||
|
|
||
| @SuppressWarnings("unchecked") | ||
| public T withValidateNotBeforeClaim(boolean validateNotBeforeClaim) { | ||
| this.validateNotBeforeClaim = validateNotBeforeClaim; | ||
| return (T) this; | ||
| } | ||
|
|
||
| @SuppressWarnings("unchecked") | ||
| public T withLeewaySeconds(int leewaySeconds) { | ||
| this.leewaySeconds = leewaySeconds; | ||
| return (T) this; | ||
| } | ||
|
|
||
| public TimeClaimVerificationOpts build() { | ||
| return new TimeClaimVerificationOpts( | ||
| validateExpirationClaim, | ||
| validateNotBeforeClaim, | ||
| leewaySeconds | ||
| ); | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.