dropwizard-auth-jwt

JSON Web Token based authentication for Dropwizard 0.8.x using the jose4j library.

Getting Started

Maven:

<dependency>
    <groupId>de.borntohula.dropwizard</groupId>
    <artifactId>dropwizard-auth-jwt</artifactId>
    <version>0.1.1</version>
</dependency>

Gradle:

compile 'de.borntohula.dropwizard:dropwizard-auth-jwt:0.1.1'

Examples

The JwtAuthFactory enables JSON Web Token authentication, and requires an authenticator which transforms the token string into a principal (see jose4j on how to consume JWTs):

@Override
public void run(ExampleConfiguration config, Environment environment) {
    final JsonWebKey jwk = OctJwkGenerator.generateJwk(2048);

    environment.jersey().register(AuthFactory.binder(
            new JwtAuthFactory<User>(new ExampleAuthenticator(jwk.getKey()),
                                     "MyRealm",
                                      User.class));
}

The abstract BaseJwtAuthenticator class provides simple validation and processing through a given JwtConsumer. Only the creation of the principal from the the claims send through the token needs to be implemented:

public class ExampleAuthenticator extends BaseJwtAuthenticator<User> {
    public ExampleAuthenticator(Key verificationKey) {
        super(new JwtConsumerBuilder()
                .setRequireExpirationTime()
                .setAllowedClockSkewInSeconds(30)
                .setRequireSubject()
                .setExpectedIssuer("Issuer")
                .setExpectedAudience("Audience")
                .setVerificationKey(verificationKey)
                .build());
    }

    @Override
    public Optional<User> validateClaims(JwtClaims claims)
            throws AuthenticationException {
        if (TokenRegistry.getInstance().isRevoked(claims.getJwtId()) {
            return Optional.absent();
        }

        return Optional.of(new User(jwtClaims.getSubject()));
    }
}

License

Apache 2.0 License. See LICENSE for further information.