import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
@Override
public SignatureVerifier getSignatureVerifier() throws Exception {
    String publicKeyEndpointUri = getTokenEndpoint().replace("/token", "/certs");
    HttpEntity<Void> request = new HttpEntity<Void>(new HttpHeaders());
    LinkedHashMap<String, List<Map<String, Object>>> result =
        restTemplate.getForObject(publicKeyEndpointUri, LinkedHashMap.class);
    Map<String, Object> properties = result.get("keys").get(0);
    BigInteger modulus = new BigInteger(1, Base64Utils.decodeFromUrlSafeString((String) properties.get("n")));
    BigInteger publicExponent = new BigInteger(1, Base64Utils.decodeFromString((String) properties.get("e")));
    try {
        PublicKey publicKey =
            KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(modulus, publicExponent));
        RSAPublicKey rsaKey = (RSAPublicKey) RSAKeyFactory.toRSAKey(publicKey);
        return new RsaVerifier(rsaKey);
    } catch (GeneralSecurityException ex) {
        log.error("could not create key verifier", ex);
        throw ex;
    }
}
 

import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
/**
 * Fetch a new public key from the AuthorizationServer.
 *
 * @return true, if we could fetch it; false, if we could not.
 */
private boolean tryCreateSignatureVerifier() {
    long t = System.currentTimeMillis();
    if (t - lastKeyFetchTimestamp < oAuth2Properties.getSignatureVerification().getPublicKeyRefreshRateLimit()) {
        return false;
    }
    try {
        SignatureVerifier verifier = signatureVerifierClient.getSignatureVerifier();
        if(verifier!=null) {
            setVerifier(verifier);
            lastKeyFetchTimestamp = t;
            log.debug("Public key retrieved from OAuth2 server to create SignatureVerifier");
            return true;
        }
    } catch (Throwable ex) {
        log.error("could not get public key from OAuth2 server to create SignatureVerifier", ex);
    }
    return false;
}
 

import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
private OAuth2Authentication getSSOAuthentication(String accessToken) {
    try {
        SignatureVerifier verifier = isAssymetricKey(jwtSignKey) ? new RsaVerifier(jwtSignKey) : new MacSigner(jwtSignKey);
        Jwt jwt = JwtHelper.decodeAndVerify(accessToken, verifier);
        Map<String, Object> claims = objectMapper.readValue(jwt.getClaims(), new MapTypeReference());
        Object userClaim = claims.get("user");
        Map<String, Object> tokenMap = new HashMap<>();
        Map<String, Object> userMap = objectMapper.readValue(userClaim.toString(), new MapTypeReference());
        String exp = claims.get("exp").toString();
        tokenMap.put("exp", Long.valueOf(exp));
        Object email = userMap.get("email");
        tokenMap.put("user_id", email);
        tokenMap.put("user_name", email);
        tokenMap.put("scope", Arrays.asList("cloudbreak.networks.read", "periscope.cluster", "cloudbreak.usages.user", "cloudbreak.recipes", "openid",
            "cloudbreak.templates.read", "cloudbreak.usages.account", "cloudbreak.events", "cloudbreak.stacks.read",
            "cloudbreak.blueprints", "cloudbreak.networks", "cloudbreak.templates", "cloudbreak.credentials.read",
            "cloudbreak.securitygroups.read", "cloudbreak.securitygroups", "cloudbreak.stacks", "cloudbreak.credentials",
            "cloudbreak.recipes.read", "cloudbreak.blueprints.read"));

        OAuth2AccessToken oAuth2AccessToken = jwtAccessTokenConverter.extractAccessToken(accessToken, tokenMap);
        if (oAuth2AccessToken.isExpired()) {
            throw new InvalidTokenException("The token has expired");
        }
        OAuth2Authentication oAuth2Authentication = jwtAccessTokenConverter.extractAuthentication(tokenMap);
        if (oAuth2Authentication != null) {
            LOGGER.info("JWT token verified for: {}", oAuth2Authentication.getPrincipal());
        }
        return oAuth2Authentication;
    } catch (IOException e) {
        LOGGER.error("Failed to parse the JWT token", e);
        throw new InvalidTokenException("The specified JWT token is invalid", e);
    }
}
 

import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
/**
 * Fetches the public key from the UAA.
 *
 * @return the public key used to verify JWT tokens; or null.
 */
@Override
public SignatureVerifier getSignatureVerifier() throws Exception {
    try {
        HttpEntity<Void> request = new HttpEntity<Void>(new HttpHeaders());
        String key = (String) restTemplate
            .exchange(getPublicKeyEndpoint(), HttpMethod.GET, request, Map.class).getBody()
            .get("value");
        return new RsaVerifier(key);
    } catch (IllegalStateException ex) {
        log.warn("could not contact UAA to get public key");
        return null;
    }
}
 

import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
@Bean
public SignatureVerifier verifier() {
    return new MacSigner("non-prod");
}
 

import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
private void downloadKeys(final String url) {
    Map<String, SignatureVerifier> tempVerifiers = new HashMap<>();
    ResponseEntity<Map> responseEntity = restTemplate.getForEntity(url, Map.class);
    Map response = responseEntity.getBody();

    for (Object key : response.keySet()) {
        String certificateString = (String)response.get(key);
        InputStream is = new ByteArrayInputStream(certificateString.getBytes(StandardCharsets.UTF_8));
        try {
            CertificateFactory f = CertificateFactory.getInstance("X.509");
            X509Certificate certificate = (X509Certificate)f.generateCertificate(is);
            PublicKey pk = certificate.getPublicKey();
            RsaVerifier verifier = new RsaVerifier((RSAPublicKey)pk);
            tempVerifiers.put((String)key, verifier);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    if (tempVerifiers.size() > 0) {
        // do we need to synchronize here?
        verifiers = tempVerifiers;
    }

    String cacheControlValue = responseEntity.getHeaders().getCacheControl();
    int maxAge = DEFAULT_MAX_AGE;
    if (cacheControlValue != null) {
        Matcher matcher = MAX_AGE_PATTERN.matcher(cacheControlValue);
        if (matcher.matches()) {
            maxAge = Integer.parseInt(matcher.group(1));
        }
    }

    // start timer to update keys
    timer.schedule(new TimerTask() {
        @Override
        public void run() {
            downloadKeys(url);
        }
    }, maxAge * 1000); // max-age is in seconds unit
}
 

import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
public static Jwt decodeAndVerify(String token, SignatureVerifier verifier) {
	Jwt jwt = decode(token);
	jwt.verifySignature(verifier);

	return jwt;
}
 

import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
/**
 * Validates a signature contained in the 'crypto' segment.
 *
 * @param verifier the signature verifier
 */
public void verifySignature(SignatureVerifier verifier) {
	verifier.verify(signingInput(), crypto);
	}
 

import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
/**
 * Returns the SignatureVerifier used to verify JWT tokens.
 * Fetches the public key from the Authorization server to create
 * this verifier.
 *
 * @return the new verifier used to verify JWT signatures.
 * Will be null if we cannot contact the token endpoint.
 * @throws Exception if we could not create a SignatureVerifier or contact the token endpoint.
 */
SignatureVerifier getSignatureVerifier() throws Exception;
 

import org.springframework.security.jwt.crypto.sign.SignatureVerifier; //导入依赖的package包/类
void verifySignature(SignatureVerifier verifier);