dropwizard-auth-jwt ![Build Status](https://camo.githubusercontent.com/3d5b8ea10106df861ca11a8732d12389888264ee32768f59d22d59e9858d5e27/68747470733a2f2f7472617669732d63692e6f72672f616e6462616e2f64726f7077697a6172642d617574682d6a77742e7376673f6272616e63683d76302e312e31)
JSON Web Token based authentication for Dropwizard 0.8.x using the jose4j library.
Getting Started
Maven:
<dependency>
<groupId>de.borntohula.dropwizard</groupId>
<artifactId>dropwizard-auth-jwt</artifactId>
<version>0.1.1</version>
</dependency>
Gradle:
compile 'de.borntohula.dropwizard:dropwizard-auth-jwt:0.1.1'
Examples
The JwtAuthFactory
enables JSON Web Token authentication, and requires an authenticator which transforms the token string into a principal (see jose4j on how to consume JWTs):
@Override
public void run(ExampleConfiguration config, Environment environment) {
final JsonWebKey jwk = OctJwkGenerator.generateJwk(2048);
environment.jersey().register(AuthFactory.binder(
new JwtAuthFactory<User>(new ExampleAuthenticator(jwk.getKey()),
"MyRealm",
User.class));
}
The abstract BaseJwtAuthenticator
class provides simple validation and processing through a given JwtConsumer
. Only the creation of the principal from the the claims send through the token needs to be implemented:
public class ExampleAuthenticator extends BaseJwtAuthenticator<User> {
public ExampleAuthenticator(Key verificationKey) {
super(new JwtConsumerBuilder()
.setRequireExpirationTime()
.setAllowedClockSkewInSeconds(30)
.setRequireSubject()
.setExpectedIssuer("Issuer")
.setExpectedAudience("Audience")
.setVerificationKey(verificationKey)
.build());
}
@Override
public Optional<User> validateClaims(JwtClaims claims)
throws AuthenticationException {
if (TokenRegistry.getInstance().isRevoked(claims.getJwtId()) {
return Optional.absent();
}
return Optional.of(new User(jwtClaims.getSubject()));
}
}
License
Apache 2.0 License. See LICENSE for further information.