Class AuthorizationServerKeys

java.lang.Object
com.codename1.backend.security.oauth2.server.authorization.AuthorizationServerKeys
public final class AuthorizationServerKeys extends Object

The keys an authorization server signs with.

cn1.security.authorizationserver.jwk.keys=/etc/acme/signing-2026.pem,/etc/acme/signing-2025.pem

Each is a PEM file holding an RSA or a P-256 private key. The first signs every new token; all of them are published at the JWK Set endpoint, so that a token signed by the key that was first until yesterday still verifies. To rotate, put the new key first and keep the old one in the list for as long as its tokens live.

A key can be made with

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out signing.pem

A key brought over from another authorization server keeps the kid its tokens already carry, or none of them would find their key. Name the ids in the same order as the files; an empty entry keeps the derived id:

cn1.security.authorizationserver.jwk.keys=/etc/acme/new.pem,/etc/acme/legacy.pem
cn1.security.authorizationserver.jwk.key-ids=,legacy-2024-rsa

A key whose private half stayed behind -- the old provider's public JWK Set or a public PEM -- can still verify the tokens it signed. List it under cn1.security.authorizationserver.jwk.verification-keys: it is published and verifies, and never signs. A .json file is read as a JWK Set and keeps each key's kid; any other file is a public key PEM under its derived id.

On a development profile with no key set, a key is made when the server starts and a warning says so: every restart then invalidates every token. Anywhere else a missing key stops the server from starting.

An application that issues tokens of its own -- a long-lived token for a build agent -- declares the keys and an encoder as beans, and the authorization server uses the same ones:

@Bean
JwkSource signingKeys(Config config) throws IOException {
    return AuthorizationServerKeys.load(config);
}

@Bean
JwtEncoder jwtEncoder(JwkSource keys) {
    return new DefaultJwtEncoder(keys);
}

  • Field Details

    • KEYS

      public static final String KEYS
      The setting that lists the key files, separated by commas.
      See Also:

    • KEY_IDS

      public static final String KEY_IDS
      The kid of each key in KEYS, in the same order; an empty entry keeps the id derived from the public key.
      See Also:

    • VERIFICATION_KEYS

      public static final String VERIFICATION_KEYS
      Public keys that verify and are published, and never sign.
      See Also:

  • Method Details

    • load

      public static JwkSource load(Config config) throws IOException

      The keys the configuration names, the signing one first.

      • IllegalStateException: when none is set outside a development profile, or one of them is not a key this server signs with
      Throws:
      IOException

    • of

      public static JwkSource of(List<Jwk> keys)
      A source of exactly these keys, the signing one first.

    • usable

      public static Jwk usable(Jwk key, String where)

      key marked as a signing key under the algorithm its kind signs with.

      • IllegalStateException: when it is neither RSA nor P-256

    • algorithm

      public static String algorithm(Jwk key)
      RS256 for an RSA key, ES256 for a P-256 one, null for any other.