Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support JWT decoding and validation #25

Open
iainmcgin opened this issue Mar 7, 2016 · 10 comments
Open

Support JWT decoding and validation #25

iainmcgin opened this issue Mar 7, 2016 · 10 comments
Milestone

Comments

@iainmcgin
Copy link
Member

Support validating JWTs and extracting their claims as a map. This will require the ability to either dynamically use the jwks_uri keys provided by the provider's discovery document, or a set of acceptable keys provided by the developer.

@b---c
Copy link

b---c commented Apr 14, 2016

Hi @iainmcgin, I'd like to ever so humbly suggest that jose4j be considered for JWT decoding and validation in AppAuth . It's an open source JWT/JOSE library in Java that has extensive support for consuming and validating JWTs including being able to dynamically obtain public keys from an HTTPS endpoint like Connect's jwks_uri.

@iainmcgin
Copy link
Member Author

jose4j looks like a good choice Brian, thanks for the suggestion! The solution for this issue may actually just be documentation rather than code, pointing developers at other libraries (such as yours) that can perform this task rather than baking it in to AppAuth itself. We'd like to keep the dependencies of AppAuth as minimal as possible.

@iainmcgin iainmcgin added this to the 0.7.0 milestone Mar 10, 2017
@iainmcgin
Copy link
Member Author

#163 has some code for this, so I'll need to evaluate that against adding a dependency on jose4j. Looks like jose4j 0.5.5 is ~250KB, which is almost twice as big as AppAuth itself (currently ~120KB). It may still be better to leave token validation to code outwith the library.

@iainmcgin iainmcgin modified the milestones: 0.8.0, 0.7.0 Aug 22, 2017
@iainmcgin
Copy link
Member Author

Partially fixed by #385 - we will need to put in some extra work to expose the new IdToken class as part of the public API. Right now it only holds the fields that are interesting for validation and discards the rest; storing the currently discarded claims as an "additionalClaims" map would be consistent with how we handle authorization requests etc.

@v-khatri
Copy link

Is IdToken available in latest release? (0.7.1)

@sunilkumarjena21
Copy link

Hi @iainmcgin ,
I am still unable to access IdToken class.
My need is to use parseJwtSection(String acessToken) method to parse the role [] from the acessToken.

Do we have any way to do it in AppAuth?
Thanks in advance!

@Whathecode
Copy link

Our codebase was relying on a separate library to extract this information. I just abandoned this library as it contained a bug, and I found it an extensive additional dependency just to do some JSON parsing which I now do as follows:

fun getUserId(token: String): UUID? {
    val (_, payload, _) = accessToken.split('.')
    val payloadString = String(
        Base64.decode(payload, Base64.URL_SAFE or Base64.NO_WRAP or Base64.NO_PADDING),
        Charset.defaultCharset()
    )
    val subjectPattern = Regex("\"sub\":\\s*\"([a-z0-9-]*)\"")
    val subject = requireNotNull(subjectPattern.find(payloadString)?.groupValues?.get(1))
        { "Invalid JWT access token."}

    return UUID.fromString(subject)
}

But, I'd prefer to replace this with the IdToken functionality of this library once it is exposed in the API. So just a reminder this issue is still relevant. :)

@CoolMind
Copy link

CoolMind commented Dec 3, 2022

@Whathecode, please, add imports. What minimal SDK does it require?

@CoolMind
Copy link

CoolMind commented Dec 4, 2022

@dr-star
Copy link

dr-star commented Jun 25, 2024

To access the claims you can do

authState.parsedIdToken.additionalClaims

See #759

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

7 participants