OIDC 深度解析#

import java.nio.charset.StandardCharsets;
import java.security.KeyFactory;
import java.security.PublicKey;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;
import java.util.Map;

public class IdTokenValidator {
    
    public record TokenClaims(
        String subject,
        String issuer,
        String audience,
        long expiresAt,
        long issuedAt,
        long authTime
    ) {}
    
    public TokenClaims validate(
            String idToken,
            String expectedIssuer,
            String expectedAudience,
            String expectedNonce,
            PublicKey signingKey) throws Exception {
        
        String[] parts = idToken.split("\\.");
        if (parts.length != 3) {
            throw new IllegalArgumentException("Invalid token format");
        }
        
        Map<String, Object> header = parseJson(decodeBase64Url(parts[0]));
        Map<String, Object> payload = parseJson(decodeBase64Url(parts[1]));
        String signature = parts[2];
        
        String algorithm = (String) header.get("alg");
        if (!algorithm.startsWith("RS")) {
            throw new SecurityException("Only RSA algorithms are allowed for ID Token");
        }
        
        String payloadJson = parts[0] + "." + parts[1];
        byte[] payloadBytes = payloadJson.getBytes(StandardCharsets.UTF_8);
        byte[] signatureBytes = decodeBase64Url(signature);
        
        if (!verifySignature(payloadBytes, signatureBytes, signingKey, algorithm)) {
            throw new SecurityException("Invalid signature");
        }
        
        String issuer = (String) payload.get("iss");
        if (!issuer.equals(expectedIssuer)) {
            throw new SecurityException("Invalid issuer");
        }
        
        String aud = (String) payload.get("aud");
        if (!aud.equals(expectedAudience)) {
            throw new SecurityException("Invalid audience");
        }
        
        long exp = ((Number) payload.get("exp")).longValue();
        if (exp * 1000L < System.currentTimeMillis()) {
            throw new SecurityException("Token expired");
        }
        
        if (expectedNonce != null) {
            String nonce = (String) payload.get("nonce");
            if (!expectedNonce.equals(nonce)) {
                throw new SecurityException("Invalid nonce");
            }
        }
        
        return new TokenClaims(
            (String) payload.get("sub"),
            issuer,
            aud,
            exp,
            ((Number) payload.get("iat")).longValue(),
            payload.containsKey("auth_time") 
                ? ((Number) payload.get("auth_time")).longValue() 
                : 0
        );
    }
    
    private byte[] decodeBase64Url(String input) {
        return Base64.getUrlDecoder().decode(input);
    }
    
    private Map<String, Object> parseJson(byte[] bytes) {
        // 简化实现，实际应使用 Jackson 或 Gson
        return Map.of();
    }
    
    private boolean verifySignature(
            byte[] data, byte[] signature, 
            PublicKey key, String algorithm) {
        // 实际实现使用 Signature 类验证
        return true;
    }
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.util.Map;

public class UserInfoClient {
    
    private final HttpClient httpClient;
    private final URI userInfoEndpoint;
    
    public UserInfoClient(HttpClient httpClient, URI userInfoEndpoint) {
        this.httpClient = httpClient;
        this.userInfoEndpoint = userInfoEndpoint;
    }
    
    public Map<String, Object> getUserInfo(String accessToken) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(userInfoEndpoint)
            .header("Authorization", "Bearer " + accessToken)
            .GET()
            .build();
        
        HttpResponse<String> response = httpClient.send(
            request, HttpResponse.BodyHandlers.ofString());
        
        if (response.statusCode() == 200) {
            return parseJson(response.body());
        }
        throw new RuntimeException("UserInfo request failed: " + response.statusCode());
    }
}