001/*******************************************************************************
002 * Copyright 2014 The MITRE Corporation
003 *   and the MIT Kerberos and Internet Trust Consortium
004 * 
005 * Licensed under the Apache License, Version 2.0 (the "License");
006 * you may not use this file except in compliance with the License.
007 * You may obtain a copy of the License at
008 * 
009 *   http://www.apache.org/licenses/LICENSE-2.0
010 * 
011 * Unless required by applicable law or agreed to in writing, software
012 * distributed under the License is distributed on an "AS IS" BASIS,
013 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014 * See the License for the specific language governing permissions and
015 * limitations under the License.
016 ******************************************************************************/
017package org.mitre.jwt.signer.service;
018
019import java.security.NoSuchAlgorithmException;
020import java.util.Collection;
021import java.util.Map;
022
023import com.nimbusds.jose.JWSAlgorithm;
024import com.nimbusds.jose.jwk.JWK;
025import com.nimbusds.jwt.SignedJWT;
026
027public interface JwtSigningAndValidationService {
028
029        /**
030         * Get all public keys for this service, mapped by their Key ID
031         */
032        public Map<String, JWK> getAllPublicKeys();
033
034        /**
035         * Checks the signature of the given JWT against all configured signers,
036         * returns true if at least one of the signers validates it.
037         * 
038         * @param jwtString
039         *            the string representation of the JWT as sent on the wire
040         * @return true if the signature is valid, false if not
041         * @throws NoSuchAlgorithmException
042         */
043        public boolean validateSignature(SignedJWT jwtString);
044
045        /**
046         * Called to sign a jwt in place for a client that hasn't registered a preferred signing algorithm.
047         * Use the default algorithm to sign.
048         * 
049         * @param jwt the jwt to sign
050         * @return the signed jwt
051         * @throws NoSuchAlgorithmException
052         */
053        public void signJwt(SignedJWT jwt);
054
055        /**
056         * Get the default signing algorithm for use when nothing else has been specified.
057         * @return
058         */
059        public JWSAlgorithm getDefaultSigningAlgorithm();
060
061        /**
062         * Get the list of all signing algorithms supported by this service.
063         * @return
064         */
065        public Collection<JWSAlgorithm> getAllSigningAlgsSupported();
066
067        /**
068         * Sign a jwt using the selected algorithm. The algorithm is selected using the String parameter values specified
069         * in the JWT spec, section 6. I.E., "HS256" means HMAC with SHA-256 and corresponds to our HmacSigner class.
070         * 
071         * @param jwt the jwt to sign
072         * @param alg the name of the algorithm to use, as specified in JWS s.6
073         * @return the signed jwt
074         */
075        public void signJwt(SignedJWT jwt, JWSAlgorithm alg);
076
077        public String getDefaultSignerKeyId();
078
079        /**
080         * TODO: method to sign a jwt using a specified algorithm and a key id
081         */
082}