Class JwksTokenValidator

java.lang.Object
io.fluxzero.idp.client.JwksTokenValidator
All Implemented Interfaces:
TokenValidator
public class JwksTokenValidator extends Object implements TokenValidator
OIDC token validator with a legacy RS256 default and explicit native signing-profile support.

The legacy constructor discovers metadata and shares an RS256 key cache by issuer. Explicit construction pins metadata, transport and a local asymmetric algorithm allowlist, with an isolated expiring public-key cache and native ID/access token types. Both profiles enforce the registered claims that make a token usable by a Fluxzero application: exact issuer match, non-empty subject, configured audience, optional Fluxzero token_use, and the iat, nbf and exp validity window.

The local stub IDP should not weaken this class. Test-specific trust belongs in another TokenValidator implementation on the test classpath so application code can keep calling TokenValidators.validate(TokenValidationRequest) in both environments.

  • Constructor Details

    • JwksTokenValidator

      public JwksTokenValidator()
      Legacy application-client profile: RS256 and Runtime-backed discovery.

    • JwksTokenValidator

      public JwksTokenValidator(OidcDiscoveryDocument discovery, OidcTransport transport, String algorithm)
      Exact issuer/algorithm and caller-owned transport; never consults the shared legacy key cache or the ServiceLoader fallback chain. The caller validates discovery/egress before supplying it. Public keys expire after five minutes. Unknown-kid refresh is bounded to once per five seconds; a known key with a bad signature never triggers a network refresh in this explicit profile.

    • JwksTokenValidator

      public JwksTokenValidator(OidcDiscoveryDocument discovery, OidcTransport transport, Set<String> allowedAlgorithms)
      Accepts only the intersection of the local allowlist and the supplied discovery advertisement.

  • Method Details

    • validate

      public JwtClaims validate(TokenValidationRequest request)
      Description copied from interface: TokenValidator
      Validates the token and returns normalized claims.
      Specified by:
      validate in interface TokenValidator
      Parameters:
      request - the token, issuer and audience expectations
      Returns:
      normalized claims from a valid token

    • validateLogout

      public LogoutTokenClaims validateLogout(TokenValidationRequest request, Duration maximumAge)
      Explicit, signed back-channel profile. Replay and session matching belong to the application. Requires pinned metadata/transport and logout+jwt; never uses the legacy/ServiceLoader path. Supports subject-only or session-bound protocol evidence without selecting a logout scope.