Package org.keycloak.representations

Class JsonWebToken

java.lang.Object
org.keycloak.representations.JsonWebToken
All Implemented Interfaces:
Serializable, Token
Direct Known Subclasses:
AuthorizationResponseToken, CIBAAuthenticationRequest, DefaultActionTokenKey, DockerResponseToken, DPoP, IDToken, InitialAccessToken, JwtCNonce, LogoutToken, PermissionTicketToken, RegistrationAccessToken, TokenIntrospectionResponse
public class JsonWebToken extends Object implements Serializable, Token
Version:
$Revision: 1 $
Author:
Bill Burke
See Also:

  • Field Details

  • Constructor Details

    • JsonWebToken

      public JsonWebToken()

  • Method Details

    • getId

      public String getId()

    • id

      public JsonWebToken id(String id)

    • getExp

      public Long getExp()

    • exp

      public JsonWebToken exp(Long exp)

    • isExpired

      public boolean isExpired()

    • getNbf

      public Long getNbf()

    • nbf

      public JsonWebToken nbf(Long nbf)

    • isNotBefore

      public boolean isNotBefore(long allowedTimeSkew)

    • isActive

      public boolean isActive()
      Tests that the token is not expired and is not-before. This assumes a default clock-skew for the "is not before" of 10 seconds which is in line FAPI 2.0. See FAPI 2.0 Security Profile:
      Clock skew is a cause of many interoperability issues. Even a few hundred milliseconds of clock skew can cause JWTs to be rejected for being "issued in the future". The DPoP specification [RFC9449] suggests that JWTs are accepted in the reasonably near future (on the order of seconds or minutes). This document goes further by requiring authorization servers to accept JWTs that have timestamps up to 10 seconds in the future. 10 seconds was chosen as a value that does not affect security while greatly increasing interoperability. Implementers are free to accept JWTs with a timestamp of up to 60 seconds in the future. Some ecosystems have found that the value of 30 seconds is needed to fully eliminate clock skew issues. To prevent implementations switching off iat and nbf checks completely this document imposes a maximum timestamp in the future of 60 seconds.

    • isActive

      public boolean isActive(int allowedTimeSkew)

    • isIssuedBeforeSessionStart

      public boolean isIssuedBeforeSessionStart(long sessionStarted)
      Parameters:
      sessionStarted - Time in seconds
      Returns:
      true if the particular token was issued before the given session start time. Which means that token cannot be issued by the particular session

    • getIat

      public Long getIat()

    • issuedNow

      public JsonWebToken issuedNow()
      Set issuedAt to the current time

    • iat

      public JsonWebToken iat(Long iat)

    • getIssuer

      public String getIssuer()

    • issuer

      public JsonWebToken issuer(String issuer)

    • getAudience

      public String[] getAudience()

    • hasAudience

      public boolean hasAudience(String audience)

    • hasAnyAudience

      public boolean hasAnyAudience(List<String> audiences)

    • audience

      public JsonWebToken audience(String... audience)

    • addAudience

      public JsonWebToken addAudience(String audience)

    • getSubject

      public String getSubject()

    • subject

      public JsonWebToken subject(String subject)

    • setSubject

      public void setSubject(String subject)

    • getType

      public String getType()

    • type

      public JsonWebToken type(String type)

    • getIssuedFor

      public String getIssuedFor()
      OAuth client the token was issued for.
      Returns:

    • issuedFor

      public JsonWebToken issuedFor(String issuedFor)

    • getOtherClaims

      public Map<String,Object> getOtherClaims()
      This is a map of any other claims and data that might be in the IDToken. Could be custom claims set up by the auth server
      Returns:

    • setOtherClaims

      public void setOtherClaims(String name, Object value)

    • getCategory

      public TokenCategory getCategory()
      Specified by:
      getCategory in interface Token

    • equals

      public final boolean equals(Object o)
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object