io.confluent.kafka.clients.plugins.auth.oauth.internals

Class SpireJwtTokenLoginValidator

java.lang.Object

io.confluent.kafka.clients.plugins.auth.oauth.internals.SpireJwtTokenLoginValidator

All Implemented Interfaces:

org.apache.kafka.common.security.oauthbearer.internals.secured.AccessTokenValidator

public class SpireJwtTokenLoginValidator
extends Object
implements org.apache.kafka.common.security.oauthbearer.internals.secured.AccessTokenValidator

A AccessTokenValidator that does basic validation of the JWT retrieved from the Spire Agent.

It validates following:

 1. `exp` claim is valid (i.e. a non-negative number that is not already expired)
 2. `iat` claim is valid (i.e. a non-negative number that is less than current time)
 3. `sub` claim is valid (i.e. a non-null, non-empty string starting with 'spiffe')
 

Field Summary

Fields

Modifier and Type	Field and Description
static String	EXPIRATION_CLAIM_NAME
static String	ISSUED_AT_CLAIM_NAME
static String	SUBJECT_CLAIM_NAME

Constructor Summary

Constructors

Constructor and Description
SpireJwtTokenLoginValidator()

Method Summary

Modifier and Type	Method and Description
org.apache.kafka.common.security.oauthbearer.OAuthBearerToken	validate(String accessToken)

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

EXPIRATION_CLAIM_NAME

public static final String EXPIRATION_CLAIM_NAME

See Also:

Constant Field Values

ISSUED_AT_CLAIM_NAME

public static final String ISSUED_AT_CLAIM_NAME

See Also:

Constant Field Values

SUBJECT_CLAIM_NAME

public static final String SUBJECT_CLAIM_NAME

See Also:

Constant Field Values

Constructor Detail

SpireJwtTokenLoginValidator

public SpireJwtTokenLoginValidator()

Method Detail

validate

public org.apache.kafka.common.security.oauthbearer.OAuthBearerToken validate(String accessToken)
                                                                       throws org.apache.kafka.common.security.oauthbearer.internals.secured.ValidateException

Specified by:

validate in interface org.apache.kafka.common.security.oauthbearer.internals.secured.AccessTokenValidator

Throws:

org.apache.kafka.common.security.oauthbearer.internals.secured.ValidateException