Interface TokenValidator

All Known Implementing Classes:
JwksTokenValidator
public interface TokenValidator
Strategy for validating OIDC JWTs.

Validators are loaded with ServiceLoader by TokenValidators. This is the extension point that lets Fluxzero applications keep one authentication flow while switching token verification based on the classpath: the production classpath can use issuer discovery and JWKS, while the test classpath can contribute a local stub validator that verifies tokens signed by the in-process stub IDP.

Implementations must perform the full validation that their trust model requires. A validator that accepts a request is expected to check at least issuer, audience, temporal validity and signature; TokenValidationRequest.expectedTokenUse() should also be honored when the token carries a Fluxzero token_use claim.

  • Method Summary

    Modifier and Type
    Method
    Description
    default int
    priority()
    Orders validators when multiple implementations are present.
    default boolean
    supports(TokenValidationRequest request)
    Returns whether this validator should try to validate the request.
    JwtClaims
    validate(TokenValidationRequest request)
    Validates the token and returns normalized claims.

  • Method Details

    • priority

      default int priority()
      Orders validators when multiple implementations are present.

      Higher values run first. Local test validators can use this to take precedence over the default JWKS validator when both are visible on the test classpath.

      Returns:
      the validator priority

    • supports

      default boolean supports(TokenValidationRequest request)
      Returns whether this validator should try to validate the request.

      Implementations should keep this cheap and side-effect free. The default returns true so simple validators can rely on validate(TokenValidationRequest) to reject tokens.

      Parameters:
      request - the token validation request
      Returns:
      whether this validator supports the request

    • validate

      JwtClaims validate(TokenValidationRequest request)
      Validates the token and returns normalized claims.
      Parameters:
      request - the token, issuer and audience expectations
      Returns:
      normalized claims from a valid token
      Throws:
      TokenValidationException - when the token is invalid or cannot be trusted