@Test public void validateIDTokenReturnsFalseOnInvalidTokenTest() throws OpenIdException { String idToken = "eyJraWQiOiIxZTlnZGs3IiwiYWxnIjoiUlMyNTYifQ.ewogImlz\n" + "cyI6ICJodHRwOi8vc2VydmVyLmV4YW1wbGUuY29tIiwKICJzdWIiOiAiMjQ4\n" + "Mjg5NzYxMDAxIiwKICJhdWQiOiAiczZCaGRSa3F0MyIsCiAibm9uY2UiOiAi\n" + "bi0wUzZfV3pBMk1qIiwKICJleHAiOiAxMzExMjgxOTcwLAogImlhdCI6IDEz\n" + "MTEyODA5NzAsCiAibmFtZSI6ICJKYW5lIERvZSIsCiAiZ2l2ZW5fbmFtZSI6\n" + "ICJKYW5lIiwKICJmYW1pbHlfbmFtZSI6ICJEb2UiLAogImdlbmRlciI6ICJm\n" + "ZW1hbGUiLAogImJpcnRoZGF0ZSI6ICIwMDAwLTEwLTMxIiwKICJlbWFpbCI6\n" + "ICJqYW5lZG9lQGV4YW1wbGUuY29tIiwKICJwaWN0dXJlIjogImh0dHA6Ly9l\n" + "eGFtcGxlLmNvbS9qYW5lZG9lL21lLmpwZyIKfQ.rHQjEmBqn9Jre0OLykYNn\n" + "spA10Qql2rvx4FsD00jwlB0Sym4NzpgvPKsDjn_wMkHxcp6CilPcoKrWHcip\n" + "R2iAjzLvDNAReF97zoJqq880ZD1bwY82JDauCXELVR9O6_B0w3K-E7yM2mac\n" + "AAgNCUwtik6SjoSUZRcf-O5lygIyLENx882p6MtmwaL1hd6qn5RZOQ0TLrOY\n" + "u0532g9Exxcm-ChymrB4xLykpDj3lUivJt63eEGGN6DH5K6o33TcxkIjNrCD\n" + "4XB1CKKumZvCedgHHF3IAK4dVEDSUoGlH9z4pP_eWYNXvqQOjGs-rDaQzUHl\n" + "6cQQWNiDpWOl_lxXjQEvQ"; assertFalse(oAuth2PlatformClient.validateIDToken(idToken)); }
public boolean validateIDToken(String idToken) throws OpenIdException { logger.debug("Enter OAuth2PlatformClient::validateIDToken"); String[] idTokenParts = idToken.split("\\."); if (idTokenParts.length < 3) { logger.debug("invalid idTokenParts length"); return false; } String idTokenHeader = base64UrlDecode(idTokenParts[0]); String idTokenPayload = base64UrlDecode(idTokenParts[1]); byte[] idTokenSignature = base64UrlDecodeToBytes(idTokenParts[2]); JSONObject idTokenHeaderJson = new JSONObject(idTokenHeader); JSONObject idTokenHeaderPayload = new JSONObject(idTokenPayload); String issuer = idTokenHeaderPayload.getString("iss"); if(!issuer.equalsIgnoreCase(oauth2Config.getIntuitIdTokenIssuer())) { logger.debug("issuer value mismtach"); return false; } JSONArray jsonaud = idTokenHeaderPayload.getJSONArray("aud"); String aud = jsonaud.getString(0); if(!aud.equalsIgnoreCase(oauth2Config.getClientId())) { logger.debug("incorrect client id"); return false; } Long expirationTimestamp = idTokenHeaderPayload.getLong("exp"); Long currentTime = System.currentTimeMillis() / 1000; if((expirationTimestamp - currentTime) <= 0) { logger.debug("expirationTimestamp has elapsed"); return false; } HashMap<String,JSONObject> keyMap = getKeyMapFromJWKSUri(); if (keyMap == null || keyMap.isEmpty()) { logger.debug("unable to retrive keyMap from JWKS url"); return false; } String keyId = idTokenHeaderJson.getString("kid"); JSONObject keyDetails = keyMap.get(keyId); String exponent = keyDetails.getString("e"); String modulo = keyDetails.getString("n"); PublicKey publicKey = getPublicKey(modulo, exponent); byte[] data = (idTokenParts[0] + "." + idTokenParts[1]).getBytes(StandardCharsets.UTF_8); try { boolean isSignatureValid = verifyUsingPublicKey(data, idTokenSignature, publicKey); logger.debug("isSignatureValid: " + isSignatureValid); return isSignatureValid; } catch (GeneralSecurityException e) { logger.error("Exception while validating ID token ", e); throw new OpenIdException(e.getMessage(), e); } }
OAuth2PlatformClient { public boolean validateIDToken(String idToken) throws OpenIdException { logger.debug("Enter OAuth2PlatformClient::validateIDToken"); String[] idTokenParts = idToken.split("\\."); if (idTokenParts.length < 3) { logger.debug("invalid idTokenParts length"); return false; } String idTokenHeader = base64UrlDecode(idTokenParts[0]); String idTokenPayload = base64UrlDecode(idTokenParts[1]); byte[] idTokenSignature = base64UrlDecodeToBytes(idTokenParts[2]); JSONObject idTokenHeaderJson = new JSONObject(idTokenHeader); JSONObject idTokenHeaderPayload = new JSONObject(idTokenPayload); String issuer = idTokenHeaderPayload.getString("iss"); if(!issuer.equalsIgnoreCase(oauth2Config.getIntuitIdTokenIssuer())) { logger.debug("issuer value mismtach"); return false; } JSONArray jsonaud = idTokenHeaderPayload.getJSONArray("aud"); String aud = jsonaud.getString(0); if(!aud.equalsIgnoreCase(oauth2Config.getClientId())) { logger.debug("incorrect client id"); return false; } Long expirationTimestamp = idTokenHeaderPayload.getLong("exp"); Long currentTime = System.currentTimeMillis() / 1000; if((expirationTimestamp - currentTime) <= 0) { logger.debug("expirationTimestamp has elapsed"); return false; } HashMap<String,JSONObject> keyMap = getKeyMapFromJWKSUri(); if (keyMap == null || keyMap.isEmpty()) { logger.debug("unable to retrive keyMap from JWKS url"); return false; } String keyId = idTokenHeaderJson.getString("kid"); JSONObject keyDetails = keyMap.get(keyId); String exponent = keyDetails.getString("e"); String modulo = keyDetails.getString("n"); PublicKey publicKey = getPublicKey(modulo, exponent); byte[] data = (idTokenParts[0] + "." + idTokenParts[1]).getBytes(StandardCharsets.UTF_8); try { boolean isSignatureValid = verifyUsingPublicKey(data, idTokenSignature, publicKey); logger.debug("isSignatureValid: " + isSignatureValid); return isSignatureValid; } catch (GeneralSecurityException e) { logger.error("Exception while validating ID token ", e); throw new OpenIdException(e.getMessage(), e); } } }
OAuth2PlatformClient { public boolean validateIDToken(String idToken) throws OpenIdException { logger.debug("Enter OAuth2PlatformClient::validateIDToken"); String[] idTokenParts = idToken.split("\\."); if (idTokenParts.length < 3) { logger.debug("invalid idTokenParts length"); return false; } String idTokenHeader = base64UrlDecode(idTokenParts[0]); String idTokenPayload = base64UrlDecode(idTokenParts[1]); byte[] idTokenSignature = base64UrlDecodeToBytes(idTokenParts[2]); JSONObject idTokenHeaderJson = new JSONObject(idTokenHeader); JSONObject idTokenHeaderPayload = new JSONObject(idTokenPayload); String issuer = idTokenHeaderPayload.getString("iss"); if(!issuer.equalsIgnoreCase(oauth2Config.getIntuitIdTokenIssuer())) { logger.debug("issuer value mismtach"); return false; } JSONArray jsonaud = idTokenHeaderPayload.getJSONArray("aud"); String aud = jsonaud.getString(0); if(!aud.equalsIgnoreCase(oauth2Config.getClientId())) { logger.debug("incorrect client id"); return false; } Long expirationTimestamp = idTokenHeaderPayload.getLong("exp"); Long currentTime = System.currentTimeMillis() / 1000; if((expirationTimestamp - currentTime) <= 0) { logger.debug("expirationTimestamp has elapsed"); return false; } HashMap<String,JSONObject> keyMap = getKeyMapFromJWKSUri(); if (keyMap == null || keyMap.isEmpty()) { logger.debug("unable to retrive keyMap from JWKS url"); return false; } String keyId = idTokenHeaderJson.getString("kid"); JSONObject keyDetails = keyMap.get(keyId); String exponent = keyDetails.getString("e"); String modulo = keyDetails.getString("n"); PublicKey publicKey = getPublicKey(modulo, exponent); byte[] data = (idTokenParts[0] + "." + idTokenParts[1]).getBytes(StandardCharsets.UTF_8); try { boolean isSignatureValid = verifyUsingPublicKey(data, idTokenSignature, publicKey); logger.debug("isSignatureValid: " + isSignatureValid); return isSignatureValid; } catch (GeneralSecurityException e) { logger.error("Exception while validating ID token ", e); throw new OpenIdException(e.getMessage(), e); } } OAuth2PlatformClient(OAuth2Config oauth2Config); protected  OAuth2PlatformClient(); }
OAuth2PlatformClient { public boolean validateIDToken(String idToken) throws OpenIdException { logger.debug("Enter OAuth2PlatformClient::validateIDToken"); String[] idTokenParts = idToken.split("\\."); if (idTokenParts.length < 3) { logger.debug("invalid idTokenParts length"); return false; } String idTokenHeader = base64UrlDecode(idTokenParts[0]); String idTokenPayload = base64UrlDecode(idTokenParts[1]); byte[] idTokenSignature = base64UrlDecodeToBytes(idTokenParts[2]); JSONObject idTokenHeaderJson = new JSONObject(idTokenHeader); JSONObject idTokenHeaderPayload = new JSONObject(idTokenPayload); String issuer = idTokenHeaderPayload.getString("iss"); if(!issuer.equalsIgnoreCase(oauth2Config.getIntuitIdTokenIssuer())) { logger.debug("issuer value mismtach"); return false; } JSONArray jsonaud = idTokenHeaderPayload.getJSONArray("aud"); String aud = jsonaud.getString(0); if(!aud.equalsIgnoreCase(oauth2Config.getClientId())) { logger.debug("incorrect client id"); return false; } Long expirationTimestamp = idTokenHeaderPayload.getLong("exp"); Long currentTime = System.currentTimeMillis() / 1000; if((expirationTimestamp - currentTime) <= 0) { logger.debug("expirationTimestamp has elapsed"); return false; } HashMap<String,JSONObject> keyMap = getKeyMapFromJWKSUri(); if (keyMap == null || keyMap.isEmpty()) { logger.debug("unable to retrive keyMap from JWKS url"); return false; } String keyId = idTokenHeaderJson.getString("kid"); JSONObject keyDetails = keyMap.get(keyId); String exponent = keyDetails.getString("e"); String modulo = keyDetails.getString("n"); PublicKey publicKey = getPublicKey(modulo, exponent); byte[] data = (idTokenParts[0] + "." + idTokenParts[1]).getBytes(StandardCharsets.UTF_8); try { boolean isSignatureValid = verifyUsingPublicKey(data, idTokenSignature, publicKey); logger.debug("isSignatureValid: " + isSignatureValid); return isSignatureValid; } catch (GeneralSecurityException e) { logger.error("Exception while validating ID token ", e); throw new OpenIdException(e.getMessage(), e); } } OAuth2PlatformClient(OAuth2Config oauth2Config); protected  OAuth2PlatformClient(); BearerTokenResponse retrieveBearerTokens(String authCode, String redirectURI); BearerTokenResponse refreshToken(String refreshToken); PlatformResponse revokeToken(String token); UserInfoResponse getUserInfo(String accessToken); boolean validateIDToken(String idToken); }
OAuth2PlatformClient { public boolean validateIDToken(String idToken) throws OpenIdException { logger.debug("Enter OAuth2PlatformClient::validateIDToken"); String[] idTokenParts = idToken.split("\\."); if (idTokenParts.length < 3) { logger.debug("invalid idTokenParts length"); return false; } String idTokenHeader = base64UrlDecode(idTokenParts[0]); String idTokenPayload = base64UrlDecode(idTokenParts[1]); byte[] idTokenSignature = base64UrlDecodeToBytes(idTokenParts[2]); JSONObject idTokenHeaderJson = new JSONObject(idTokenHeader); JSONObject idTokenHeaderPayload = new JSONObject(idTokenPayload); String issuer = idTokenHeaderPayload.getString("iss"); if(!issuer.equalsIgnoreCase(oauth2Config.getIntuitIdTokenIssuer())) { logger.debug("issuer value mismtach"); return false; } JSONArray jsonaud = idTokenHeaderPayload.getJSONArray("aud"); String aud = jsonaud.getString(0); if(!aud.equalsIgnoreCase(oauth2Config.getClientId())) { logger.debug("incorrect client id"); return false; } Long expirationTimestamp = idTokenHeaderPayload.getLong("exp"); Long currentTime = System.currentTimeMillis() / 1000; if((expirationTimestamp - currentTime) <= 0) { logger.debug("expirationTimestamp has elapsed"); return false; } HashMap<String,JSONObject> keyMap = getKeyMapFromJWKSUri(); if (keyMap == null || keyMap.isEmpty()) { logger.debug("unable to retrive keyMap from JWKS url"); return false; } String keyId = idTokenHeaderJson.getString("kid"); JSONObject keyDetails = keyMap.get(keyId); String exponent = keyDetails.getString("e"); String modulo = keyDetails.getString("n"); PublicKey publicKey = getPublicKey(modulo, exponent); byte[] data = (idTokenParts[0] + "." + idTokenParts[1]).getBytes(StandardCharsets.UTF_8); try { boolean isSignatureValid = verifyUsingPublicKey(data, idTokenSignature, publicKey); logger.debug("isSignatureValid: " + isSignatureValid); return isSignatureValid; } catch (GeneralSecurityException e) { logger.error("Exception while validating ID token ", e); throw new OpenIdException(e.getMessage(), e); } } OAuth2PlatformClient(OAuth2Config oauth2Config); protected  OAuth2PlatformClient(); BearerTokenResponse retrieveBearerTokens(String authCode, String redirectURI); BearerTokenResponse refreshToken(String refreshToken); PlatformResponse revokeToken(String token); UserInfoResponse getUserInfo(String accessToken); boolean validateIDToken(String idToken);  }