io.confluent.security.authentication.oauthbearer

Class JwtIssuerSpire

java.lang.Object

io.confluent.security.authentication.oauthbearer.JwtIssuer

io.confluent.security.authentication.oauthbearer.JwtIssuerSpire

All Implemented Interfaces:

JwtIssuerSpireConfigurator

public class JwtIssuerSpire
extends JwtIssuer
implements JwtIssuerSpireConfigurator

JwtIssuer which fetches trust bundle JwtBundle from SPIRE workload API.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	JwtIssuerSpire.Builder Constructs a new JwtIssuerSpire instance.

Constructor Summary

Constructors

Constructor and Description
JwtIssuerSpire(String name, Set<String> audience, String spireIssuerSuffix)

Method Summary

Modifier and Type	Method and Description
Set<String>	audience() The recipient(s) for this token.
static JwtIssuerSpire.Builder	builder()
void	configureJwtSource(String spireAgentSocketEndpoint) Set SPIRE agent endpoint where trust bundle JwtBundle can be fetched.
ConstrainedVerificationKeyResolver	keyResolver(Collection<Constraint> constraints, SecurityContext context) Returns Signature Verification Key identified by HeaderParameterNames.KEY_ID
String	name() JsonWebSignature Issuer name.
String	spireAgentSocketEndpoint() SPIRE endpoint hosting the SPIRE Agent.

Methods inherited from class io.confluent.security.authentication.oauthbearer.JwtIssuer

createConsumer

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

JwtIssuerSpire

public JwtIssuerSpire(String name,
                      Set<String> audience,
                      String spireIssuerSuffix)

Method Detail

configureJwtSource

public void configureJwtSource(String spireAgentSocketEndpoint)

Set SPIRE agent endpoint where trust bundle JwtBundle can be fetched. Initializes JwtSource

Specified by:

configureJwtSource in interface JwtIssuerSpireConfigurator

name

public String name()

JsonWebSignature Issuer name. This should be the URL of the Authorization Server though there may be some cases where its not. RFC7519

Specified by:

name in class JwtIssuer

Returns:

JsonWebSignature Issuing authority.

audience

public Set<String> audience()

The recipient(s) for this token. RFC-7519 Section 4.1.3

Specified by:

audience in class JwtIssuer

Returns:

audience claim value.

spireAgentSocketEndpoint

public String spireAgentSocketEndpoint()

SPIRE endpoint hosting the SPIRE Agent.

keyResolver

public ConstrainedVerificationKeyResolver keyResolver(Collection<Constraint> constraints,
                                                      SecurityContext context)

Returns Signature Verification Key identified by HeaderParameterNames.KEY_ID

Specified by:

keyResolver in class JwtIssuer

Parameters:

constraints - Collection of Constraint to be enforced.

Returns:

ConstrainedVerificationKeyResolver

builder

public static JwtIssuerSpire.Builder builder()