Skip to content

Commit 2fd2a40

Browse files
TakahikoKawasakiTakahikoKawasaki
committed
[feature] /.well-known/jwt-issuer
1 parent 22eb216 commit 2fd2a40

File tree

7 files changed

+124
-34
lines changed

7 files changed

+124
-34
lines changed

‎README.ja.md‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -94,19 +94,22 @@ Docker を利用する場合は, ステップ 2 の後に以下のコマンド
9494

9595
この実装は、下表に示すエンドポイントを公開します。
9696

97-
| エンドポイント | パス |
98-
|:-----------------------------------|:------------------------------------|
99-
| 認可エンドポイント | `/api/authorization` |
100-
| トークンエンドポイント | `/api/token` |
101-
| JWK Set エンドポイント | `/api/jwks` |
102-
| 設定エンドポイント | `/.well-known/openid-configuration` |
103-
| 取り消しエンドポイント | `/api/revocation` |
104-
| イントロスペクションエンドポイント | `/api/introspection` |
105-
| ユーザー情報エンドポイント | `/api/userinfo` |
106-
| 動的クライアント登録エンドポイント | `/api/register` |
107-
| PAR エンドポイント | `/api/par` |
108-
| グラント管理エンドポイント | `/api/gm/{grantId}` |
109-
| フェデレーション設定エンドポイント | `/.well-known/openid-federation` |
97+
| エンドポイント | パス |
98+
|:-----------------------------------------------|:----------------------------------------|
99+
| 認可エンドポイント | `/api/authorization` |
100+
| トークンエンドポイント | `/api/token` |
101+
| JWK Set エンドポイント | `/api/jwks` |
102+
| ディスカバリーエンドポイント | `/.well-known/openid-configuration` |
103+
| 取り消しエンドポイント | `/api/revocation` |
104+
| イントロスペクションエンドポイント | `/api/introspection` |
105+
| ユーザー情報エンドポイント | `/api/userinfo` |
106+
| 動的クライアント登録エンドポイント | `/api/register` |
107+
| PAR エンドポイント | `/api/par` |
108+
| グラント管理エンドポイント | `/api/gm/{grantId}` |
109+
| フェデレーション設定エンドポイント | `/.well-known/openid-federation` |
110+
| フェデレーション登録エンドポイント | `/api/federation/register` |
111+
| クレデンシャルイシュアメタデータエンドポイント | `/.well-known/openid-credential-issuer` |
112+
| JWT イシュアメタデータエンドポイント | `/.well-known/jwt-issuer` |
110113

111114
認可エンドポイントとトークンエンドポイントは、[RFC 6749][1]、[OpenID Connect Core 1.0][13]、
112115
[OAuth 2.0 Multiple Response Type Encoding Practices][33]、[RFC 7636][14] ([PKCE][15])、
@@ -139,7 +142,7 @@ Web API です。 その動作は [RFC 9126][45] で定義されています。
139142
その動作は [Grant Management for OAuth 2.0][46] で定義されています。
140143

141144
フェデレーション設定エンドポイントは、認可サーバーのエンティティコンフィギュレーションを
142-
JWT 形式で返す Web API です。その動作は [OpenID Connect Federation 1.0][OIDC_FED]
145+
JWT 形式で返す Web API です。その動作は [OpenID Federation 1.0][OIDFED]
143146
で定義されています。
144147

145148

@@ -291,5 +294,5 @@ Authlete はユーザーアカウントを管理しないので、基本的に
291294
[45]: https://www.rfc-editor.org/rfc/rfc9126.html
292295
[46]: https://openid.net/specs/fapi-grant-management.html
293296
[IDA]: https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html
294-
[OIDC_FED]: https://openid.net/specs/openid-connect-federation-1_0.html
297+
[OIDFED]: https://openid.net/specs/openid-federation-1_0.html
295298

‎README.md‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -95,19 +95,22 @@ Endpoints
9595

9696
This implementation exposes endpoints as listed in the table below.
9797

98-
| Endpoint | Path |
99-
|:-------------------------------------|:------------------------------------|
100-
| Authorization Endpoint | `/api/authorization` |
101-
| Token Endpoint | `/api/token` |
102-
| JWK Set Endpoint | `/api/jwks` |
103-
| Configuration Endpoint | `/.well-known/openid-configuration` |
104-
| Revocation Endpoint | `/api/revocation` |
105-
| Introspection Endpoint | `/api/introspection` |
106-
| UserInfo Endpoint | `/api/userinfo` |
107-
| Dynamic Client Registration Endpoint | `/api/register` |
108-
| Pushed Authorization Request Endpoint| `/api/par` |
109-
| Grant Management Endpoint | `/api/gm/{grantId}` |
110-
| Federation Configuration Endpoint | `/.well-known/openid-federation` |
98+
| Endpoint | Path |
99+
|:-------------------------------------|:----------------------------------------|
100+
| Authorization Endpoint | `/api/authorization` |
101+
| Token Endpoint | `/api/token` |
102+
| JWK Set Endpoint | `/api/jwks` |
103+
| Discovery Endpoint | `/.well-known/openid-configuration` |
104+
| Revocation Endpoint | `/api/revocation` |
105+
| Introspection Endpoint | `/api/introspection` |
106+
| UserInfo Endpoint | `/api/userinfo` |
107+
| Dynamic Client Registration Endpoint | `/api/register` |
108+
| Pushed Authorization Request Endpoint| `/api/par` |
109+
| Grant Management Endpoint | `/api/gm/{grantId}` |
110+
| Federation Configuration Endpoint | `/.well-known/openid-federation` |
111+
| Federation Registration Endpoint | `/api/federation/register` |
112+
| Credential Issuer Metadata Endpoint | `/.well-known/openid-credential-issuer` |
113+
| JWT Issuer Metadata Endpoint | `/.well-known/jwt-issuer` |
111114

112115
The authorization endpoint and the token endpoint accept parameters described
113116
in [RFC 6749][1], [OpenID Connect Core 1.0][13],
@@ -143,7 +146,7 @@ and revoke a grant ID. Its behavior is defined in [Grant Management for OAuth 2.
143146

144147
The federation configuration endpoint is a Web API that publishes the entity
145148
configuration of the authorization server in the JWT format. Its behavior is
146-
defined in [OpenID Connect Federation 1.0][OIDC_FED].
149+
defined in [OpenID Federation 1.0][OIDFED].
147150

148151

149152
Authorization Request Example
@@ -298,4 +301,4 @@ Contact
298301
[45]: https://www.rfc-editor.org/rfc/rfc9126.html
299302
[46]: https://openid.net/specs/fapi-grant-management.html
300303
[IDA]: https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html
301-
[OIDC_FED]: https://openid.net/specs/openid-connect-federation-1_0.html
304+
[OIDFED]: https://openid.net/specs/openid-federation-1_0.html

‎authlete.properties‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,10 @@ base_url = https://api.authlete.com
4040
#
4141
service.api_key = 5593494639
4242
service.api_secret = AAw0rner_-y1A6J9s20wjRCpkBvez3GxEBoL9jOJVR0
43+
44+
# For Authlete 3.0
45+
#
46+
#api_version = V3
47+
#base_url = https://nextdev-api.authlete.net
48+
#service.api_key = 986126671
49+
#service.access_token =

‎pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212
<properties>
1313
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1414

15-
<authlete.java.common.version>3.75</authlete.java.common.version>
16-
<authlete.java.jaxrs.version>2.62</authlete.java.jaxrs.version>
15+
<authlete.java.common.version>3.80</authlete.java.common.version>
16+
<authlete.java.jaxrs.version>2.65</authlete.java.jaxrs.version>
1717
<javax.servlet-api.version>3.0.1</javax.servlet-api.version>
1818
<jersey.version>2.30.1</jersey.version>
1919
<jetty.version>9.4.27.v20200227</jetty.version>

‎src/main/java/com/authlete/jaxrs/server/api/vci/CredentialJwtIssuerEndpoint.java‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/*
2+
* Copyright (C) 2023 Authlete, Inc.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing,
11+
* software distributed under the License is distributed on an
12+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
13+
* either express or implied. See the License for the specific
14+
* language governing permissions and limitations under the
15+
* License.
16+
*/
17+
package com.authlete.jaxrs.server.api.vci;
18+
19+
20+
import javax.ws.rs.GET;
21+
import javax.ws.rs.Path;
22+
import javax.ws.rs.WebApplicationException;
23+
import javax.ws.rs.core.Response;
24+
import com.authlete.common.api.AuthleteApi;
25+
import com.authlete.common.api.AuthleteApiFactory;
26+
import com.authlete.common.dto.CredentialJwtIssuerMetadataRequest;
27+
import com.authlete.common.dto.CredentialJwtIssuerMetadataResponse;
28+
import com.authlete.jaxrs.server.util.ResponseUtil;
29+
30+
31+
@Path("/.well-known/jwt-issuer")
32+
public class CredentialJwtIssuerEndpoint extends AbstractCredentialEndpoint
33+
{
34+
@GET
35+
public Response get()
36+
{
37+
final AuthleteApi api = AuthleteApiFactory.getDefaultApi();
38+
39+
return metadata(api);
40+
}
41+
42+
43+
private Response metadata(AuthleteApi api) throws WebApplicationException
44+
{
45+
CredentialJwtIssuerMetadataRequest request =
46+
new CredentialJwtIssuerMetadataRequest()
47+
.setPretty(true);
48+
49+
CredentialJwtIssuerMetadataResponse response =
50+
api.credentialJwtIssuerMetadata(request);
51+
52+
String content = response.getResponseContent();
53+
54+
switch (response.getAction())
55+
{
56+
case NOT_FOUND:
57+
return ResponseUtil.notFoundJson(content);
58+
59+
case OK:
60+
return ResponseUtil.okJson(content);
61+
62+
case INTERNAL_SERVER_ERROR:
63+
default:
64+
return ResponseUtil.internalServerError(content);
65+
}
66+
}
67+
}

‎src/main/webapp/WEB-INF/web.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
com.authlete.jaxrs.server.api.vci.BatchCredentialEndpoint,
3737
com.authlete.jaxrs.server.api.vci.CredentialEndpoint,
3838
com.authlete.jaxrs.server.api.vci.CredentialMetadataEndpoint,
39+
com.authlete.jaxrs.server.api.vci.CredentialJwtIssuerEndpoint,
3940
com.authlete.jaxrs.server.api.vci.DeferredCredentialEndpoint,
4041
com.authlete.jaxrs.server.api.vci.CredentialOfferEndpoint,
4142
com.authlete.jaxrs.server.api.vci.CredentialOfferIssueEndpoint,
@@ -89,6 +90,7 @@
8990
<url-pattern>/.well-known/openid-configuration</url-pattern>
9091
<url-pattern>/.well-known/openid-credential-issuer</url-pattern>
9192
<url-pattern>/.well-known/openid-federation</url-pattern>
93+
<url-pattern>/.well-known/jwt-issuer</url-pattern>
9294
<url-pattern>/.well-known/apple-app-site-association</url-pattern>
9395
</filter-mapping>
9496

‎src/main/webapp/index.html‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
<td><a href="/api/jwks">/api/jwks</a></td>
3737
</tr>
3838
<tr>
39-
<td valign="top">Configuration Endpoint</td>
39+
<td valign="top">Discovery Endpoint</td>
4040
<td><a href="/.well-known/openid-configuration">/.well-known/openid-configuration</a></td>
4141
</tr>
4242
<tr>
@@ -57,7 +57,7 @@
5757
</tr>
5858
<tr>
5959
<td valign="top">Grant Management Endpoint</td>
60-
<td>/api/gm</td>
60+
<td>/api/gm/{grantId}</td>
6161
</tr>
6262
<tr>
6363
<td valign="top">Federation Configuration Endpoint</td>
@@ -67,6 +67,14 @@
6767
<td valign="top">Federation Registration Endpoint</td>
6868
<td>/api/federation/register</td>
6969
</tr>
70+
<tr>
71+
<td valign="top">Credential Issuer Metadata Endpoint</td>
72+
<td><a href="/.well-known/openid-credential-issuer">/.well-known/openid-credential-issuer</a></td>
73+
</tr>
74+
<tr>
75+
<td valign="top">JWT Issuer Metadata Endpoint</td>
76+
<td><a href="/.well-known/jwt-issuer">/.well-known/jwt-issuer</a></td>
77+
</tr>
7078
</tbody>
7179
</table>
7280

0 commit comments

Comments
 (0)