Add files via upload

Signed-off-by: Gilbert Algordo <[email protected]>

GoogleIdTokenVerifier.java

@@ -0,0 +1,325 @@
+/*
+ * Copyright 2012 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package com.google.api.client.googleapis.auth.oauth2;
+
+import com.google.api.client.auth.openidconnect.IdToken;
+import com.google.api.client.auth.openidconnect.IdTokenVerifier;
+import com.google.api.client.http.HttpTransport;
+import com.google.api.client.json.JsonFactory;
+import com.google.api.client.util.Beta;
+import com.google.api.client.util.Clock;
+import com.google.api.client.util.Preconditions;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.PublicKey;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * {@link Beta} <br>
+ * Thread-safe Google ID token verifier.
+ *
+ * <p>Call {@link #verify(IdToken)} to verify a ID token. Use the constructor {@link
+ * #GoogleIdTokenVerifier(HttpTransport, JsonFactory)} for the typical simpler case if your
+ * application has only a single instance of {@link GoogleIdTokenVerifier}. Otherwise, ideally you
+ * should use {@link #GoogleIdTokenVerifier(GooglePublicKeysManager)} with a shared global instance
+ * of the {@link GooglePublicKeysManager} since that way the Google public keys are cached. Sample
+ * usage:
+ *
+ * <pre>{@code
+ * GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(transport, jsonFactory)
+ *        .setAudience(Arrays.asList("myClientId"))
+ *        .build();
+ *
+ * ...
+ *
+ * if (!verifier.verify(googleIdToken)) {...}
+ * }</pre>
+ *
+ * @since 1.7
+ */
+@Beta
+public class GoogleIdTokenVerifier extends IdTokenVerifier {
+
+  /** Google public keys manager. */
+  private final GooglePublicKeysManager publicKeys;
+
+  /**
+   * @param transport HTTP transport
+   * @param jsonFactory JSON factory
+   */
+  public GoogleIdTokenVerifier(HttpTransport transport, JsonFactory jsonFactory) {
+    this(new Builder(transport, jsonFactory));
+  }
+
+  /**
+   * @param publicKeys Google public keys manager
+   * @since 1.17
+   */
+  public GoogleIdTokenVerifier(GooglePublicKeysManager publicKeys) {
+    this(new Builder(publicKeys));
+  }
+
+  /**
+   * @param builder builder
+   * @since 1.14
+   */
+  protected GoogleIdTokenVerifier(Builder builder) {
+    super(builder);
+    publicKeys = builder.publicKeys;
+  }
+
+  /**
+   * Returns the Google public keys manager.
+   *
+   * @since 1.17
+   */
+  public final GooglePublicKeysManager getPublicKeysManager() {
+    return publicKeys;
+  }
+
+  /**
+   * Returns the HTTP transport.
+   *
+   * @since 1.14
+   */
+  public final HttpTransport getTransport() {
+    return publicKeys.getTransport();
+  }
+
+  /** Returns the JSON factory. */
+  public final JsonFactory getJsonFactory() {
+    return publicKeys.getJsonFactory();
+  }
+
+  /**
+   * Returns the public certificates encoded URL.
+   *
+   * @since 1.15
+   * @deprecated (scheduled to be removed in 1.18) Use {@link #getPublicKeysManager()} and {@link
+   *     GooglePublicKeysManager#getPublicCertsEncodedUrl()} instead.
+   */
+  @Deprecated
+  public final String getPublicCertsEncodedUrl() {
+    return publicKeys.getPublicCertsEncodedUrl();
+  }
+
+  /**
+   * Returns the public keys.
+   *
+   * <p>Upgrade warning: in prior version 1.16 it may return {@code null} and not throw any
+   * exceptions, but starting with version 1.17 it cannot return {@code null} and may throw {@link
+   * GeneralSecurityException} or {@link IOException}.
+   *
+   * @deprecated (scheduled to be removed in 1.18) Use {@link #getPublicKeysManager()} and {@link
+   *     GooglePublicKeysManager#getPublicKeys()} instead.
+   */
+  @Deprecated
+  public final List<PublicKey> getPublicKeys() throws GeneralSecurityException, IOException {
+    return publicKeys.getPublicKeys();
+  }
+
+  /**
+   * Returns the expiration time in milliseconds to be used with {@link Clock#currentTimeMillis()}
+   * or {@code 0} for none.
+   *
+   * @deprecated (scheduled to be removed in 1.18) Use {@link #getPublicKeysManager()} and {@link
+   *     GooglePublicKeysManager#getExpirationTimeMilliseconds()} instead.
+   */
+  @Deprecated
+  public final long getExpirationTimeMilliseconds() {
+    return publicKeys.getExpirationTimeMilliseconds();
+  }
+
+  /**
+   * Verifies that the given ID token is valid using the cached public keys.
+   *
+   * <p>It verifies:
+   *
+   * <ul>
+   *   <li>The RS256 signature, which uses RSA and SHA-256 based on the public keys downloaded from
+   *       the public certificate endpoint.
+   *   <li>The current time against the issued at and expiration time (allowing for a 5 minute clock
+   *       skew).
+   *   <li>The issuer is {@code "accounts.google.com"} or {@code "https://accounts.google.com"}.
+   * </ul>
+   *
+   * @param googleIdToken Google ID token
+   * @return {@code true} if verified successfully or {@code false} if failed
+   */
+  public boolean verify(GoogleIdToken googleIdToken) throws GeneralSecurityException, IOException {
+    // check the payload only
+    if (!super.verifyPayload(googleIdToken)) {
+      return false;
+    }
+
+    // verify signature, try all public keys in turn.
+    for (PublicKey publicKey : publicKeys.getPublicKeys()) {
+      if (googleIdToken.verifySignature(publicKey)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Verifies that the given ID token is valid using {@link #verify(GoogleIdToken)} and returns the
+   * ID token if succeeded.
+   *
+   * @param idTokenString Google ID token string
+   * @return Google ID token if verified successfully or {@code null} if failed
+   * @since 1.9
+   */
+  public GoogleIdToken verify(String idTokenString) throws GeneralSecurityException, IOException {
+    GoogleIdToken idToken = GoogleIdToken.parse(getJsonFactory(), idTokenString);
+    return verify(idToken) ? idToken : null;
+  }
+
+  /**
+   * Downloads the public keys from the public certificates endpoint at {@link
+   * #getPublicCertsEncodedUrl}.
+   *
+   * <p>This method is automatically called if the public keys have not yet been initialized or if
+   * the expiration time is very close, so normally this doesn't need to be called. Only call this
+   * method explicitly to force the public keys to be updated.
+   *
+   * @deprecated (scheduled to be removed in 1.18) Use {@link #getPublicKeysManager()} and {@link
+   *     GooglePublicKeysManager#refresh()} instead.
+   */
+  @Deprecated
+  public GoogleIdTokenVerifier loadPublicCerts() throws GeneralSecurityException, IOException {
+    publicKeys.refresh();
+    return this;
+  }
+
+  /**
+   * {@link Beta} <br>
+   * Builder for {@link GoogleIdTokenVerifier}.
+   *
+   * <p>Implementation is not thread-safe.
+   *
+   * @since 1.9
+   */
+  @Beta
+  public static class Builder extends IdTokenVerifier.Builder {
+
+    /** Google public keys manager. */
+    GooglePublicKeysManager publicKeys;
+
+    /**
+     * @param transport HTTP transport
+     * @param jsonFactory JSON factory
+     */
+    public Builder(HttpTransport transport, JsonFactory jsonFactory) {
+      this(new GooglePublicKeysManager(transport, jsonFactory));
+    }
+
+    /**
+     * @param publicKeys Google public keys manager
+     * @since 1.17
+     */
+    public Builder(GooglePublicKeysManager publicKeys) {
+      this.publicKeys = Preconditions.checkNotNull(publicKeys);
+      setIssuers(Arrays.asList("accounts.google.com", "https://accounts.google.com"));
+    }
+
+    /** Builds a new instance of {@link GoogleIdTokenVerifier}. */
+    @Override
+    public GoogleIdTokenVerifier build() {
+      return new GoogleIdTokenVerifier(this);
+    }
+
+    /**
+     * Returns the Google public keys manager.
+     *
+     * @since 1.17
+     */
+    public final GooglePublicKeysManager getPublicCerts() {
+      return publicKeys;
+    }
+
+    /** Returns the HTTP transport. */
+    public final HttpTransport getTransport() {
+      return publicKeys.getTransport();
+    }
+
+    /** Returns the JSON factory. */
+    public final JsonFactory getJsonFactory() {
+      return publicKeys.getJsonFactory();
+    }
+
+    /**
+     * Returns the public certificates encoded URL.
+     *
+     * @since 1.15
+     * @deprecated (scheduled to be removed in 1.18) Use {@link #getPublicCerts()} and {@link
+     *     GooglePublicKeysManager#getPublicCertsEncodedUrl()} instead.
+     */
+    @Deprecated
+    public final String getPublicCertsEncodedUrl() {
+      return publicKeys.getPublicCertsEncodedUrl();
+    }
+
+    /**
+     * Sets the public certificates encoded URL.
+     *
+     * <p>The default value is {@link GoogleOAuthConstants#DEFAULT_PUBLIC_CERTS_ENCODED_URL}.
+     *
+     * <p>Overriding is only supported for the purpose of calling the super implementation and
+     * changing the return type, but nothing else.
+     *
+     * @since 1.15
+     * @deprecated (scheduled to be removed in 1.18) Use {@link
+     *     GooglePublicKeysManager.Builder#setPublicCertsEncodedUrl(String)} instead.
+     */
+    @Deprecated
+    public Builder setPublicCertsEncodedUrl(String publicKeysEncodedUrl) {
+      // TODO(yanivi): make publicKeys field final when this method is removed
+      publicKeys =
+          new GooglePublicKeysManager.Builder(getTransport(), getJsonFactory())
+              .setPublicCertsEncodedUrl(publicKeysEncodedUrl)
+              .setClock(publicKeys.getClock())
+              .build();
+      return this;
+    }
+
+    @Override
+    public Builder setIssuer(String issuer) {
+      return (Builder) super.setIssuer(issuer);
+    }
+
+    /** @since 1.21.0 */
+    @Override
+    public Builder setIssuers(Collection<String> issuers) {
+      return (Builder) super.setIssuers(issuers);
+    }
+
+    @Override
+    public Builder setAudience(Collection<String> audience) {
+      return (Builder) super.setAudience(audience);
+    }
+
+    @Override
+    public Builder setAcceptableTimeSkewSeconds(long acceptableTimeSkewSeconds) {
+      return (Builder) super.setAcceptableTimeSkewSeconds(acceptableTimeSkewSeconds);
+    }
+
+    @Override
+    public Builder setClock(Clock clock) {
+      return (Builder) super.setClock(clock);
+    }
+  }
+}