spiffe / java-spiffe / 79

pending completion

Build # 79

Build Type

Pull #22

travis-ci

Committed by

web-flow

Commit Message

<a href="https://github.com/spiffe/java-spiffe/commit/<a class=hub.com/spiffe/java-spiffe/commit/<a class="double-link" href="https://git"><a class=hub.com/spiffe/java-spiffe/commit/<a class="double-link" href="https://git"><a class=hub.com/spiffe/java-spiffe/commit/<a class="double-link" href="https://git"><a class=hub.com/spiffe/java-spiffe/commit/bfe34efdeb2e688564607df83679e53d7b6766a8">bfe34efde">&lt;a href=&quot;https://github.com/spiffe/java-spiffe/commit/</a><a class="double-link" href="https://github.com/spiffe/java-spiffe/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/spiffe/java-spiffe/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/spiffe/java-spiffe/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/spiffe/java-spiffe/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/spiffe/java-spiffe/commit/bfe34efdeb2e688564607df83679e53d7b6766a8">bfe34efde</a><a href="https://github.com/spiffe/java-spiffe/commit/bfe34efdeb2e688564607df83679e53d7b6766a8">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/spiffe/java-spiffe/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/spiffe/java-spiffe/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/spiffe/java-spiffe/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/spiffe/java-spiffe/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/spiffe/java-spiffe/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/spiffe/java-spiffe/commit/bfe34efdeb2e688564607df83679e53d7b6766a8&quot;&gt;bfe34efde&lt;/a&gt;&lt;a href=&quot;https://github.com/spiffe/java-spiffe/commit/bfe34efdeb2e688564607df83679e53d7b6766a8&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/spiffe/java-spiffe/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/spiffe/java-spiffe/comm... (continued)

Pull Request Pull Request #22: Define and implement v2 interface.

Run Details

1402 of 1402 new or added lines in 38 files covered. (100.0%)

1378 of 1402 relevant lines covered (98.29%)

2.95 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

97.7

/java-spiffe-core/src/main/java/io/spiffe/svid/jwtsvid/JwtSvid.java

package io.spiffe.svid.jwtsvid;

import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSVerifier;
import com.nimbusds.jose.crypto.ECDSAVerifier;
import com.nimbusds.jose.crypto.RSASSAVerifier;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import io.spiffe.Algorithm;
import io.spiffe.bundle.BundleSource;
import io.spiffe.bundle.jwtbundle.JwtBundle;
import io.spiffe.exception.AuthorityNotFoundException;
import io.spiffe.exception.BundleNotFoundException;
import io.spiffe.exception.JwtSvidException;
import io.spiffe.spiffeid.SpiffeId;
import lombok.NonNull;
import lombok.Value;
import lombok.val;
import org.apache.commons.lang3.StringUtils;

import java.security.PublicKey;
import java.security.interfaces.ECPublicKey;
import java.security.interfaces.RSAPublicKey;
import java.text.ParseException;
import java.util.Collections;
import java.util.Date;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;

/**
 * Represents a SPIFFE JWT-SVID.
 */
@Value
public class JwtSvid {

    /**
     * SPIFFE ID of the JWT-SVID as present in the 'sub' claim.
     */
    SpiffeId spiffeId;

    /**
     * Audience is the intended recipients of JWT-SVID as present in the 'aud' claim.
     */
    Set<String> audience;

    /**
     * Expiration time of JWT-SVID as present in 'exp' claim.
     */
    Date expiry;

    /**
     * Parsed claims from token.
     */
    Map<String, Object> claims;

    /**
     * Serialized JWT token.
     */
    String token;

    private JwtSvid(final SpiffeId spiffeId,
            final Set<String> audience,
            final Date expiry,
            final Map<String, Object> claims,
            final String token) {
        this.spiffeId = spiffeId;
        this.audience = audience;
        this.expiry = expiry;
        this.claims = claims;
        this.token = token;
    }

    /**
     * Parses and validates a JWT-SVID token and returns an instance of {@link JwtSvid}.
     * <p>
     * The JWT-SVID signature is verified using the JWT bundle source.
     *
     * @param token           a token as a string that is parsed and validated
     * @param jwtBundleSource an implementation of a {@link BundleSource} that provides the JWT authorities to
     *                        verify the signature
     * @param audience        audience as a list of strings used to validate the 'aud' claim
     * @return an instance of a {@link JwtSvid} with a SPIFFE ID parsed from the 'sub', audience from 'aud', and expiry
     * from 'exp' claim.
     * @throws JwtSvidException when the token expired or the expiration claim is missing,
     *                                           when the algorithm is not supported, when the header 'kid' is missing,
     *                                           when the signature cannot be verified, or
     *                                           when the 'aud' claim has an audience that is not in the audience list
     *                                           provided as parameter
     * @throws IllegalArgumentException          when the token is blank or cannot be parsed
     * @throws BundleNotFoundException           if the bundle for the trust domain of the spiffe id from the 'sub'
     * cannot be found
     *                                           in the JwtBundleSource
     * @throws AuthorityNotFoundException        if the authority cannot be found in the bundle using the value from
     * the 'kid' header
     */
    public static JwtSvid parseAndValidate(@NonNull final String token,
                                           @NonNull final BundleSource<JwtBundle> jwtBundleSource,
                                           @NonNull final Set<String> audience)
            throws JwtSvidException, BundleNotFoundException, AuthorityNotFoundException {

        if (StringUtils.isBlank(token)) {
            throw new IllegalArgumentException("Token cannot be blank");
        }

        val signedJwt = getSignedJWT(token);
        val claimsSet = getJwtClaimsSet(signedJwt);

        validateAudience(claimsSet.getAudience(), audience);

        val expirationTime = claimsSet.getExpirationTime();
        validateExpiration(expirationTime);

        val spiffeId = getSpiffeIdOfSubject(claimsSet);
        val jwtBundle = jwtBundleSource.getBundleForTrustDomain(spiffeId.getTrustDomain());

        val keyId = getKeyId(signedJwt.getHeader());
        val jwtAuthority = jwtBundle.findJwtAuthority(keyId);

        val algorithm = signedJwt.getHeader().getAlgorithm().getName();
        verifySignature(signedJwt, jwtAuthority, algorithm, keyId);

        val claimAudience = new HashSet<>(claimsSet.getAudience());
        return new JwtSvid(spiffeId, claimAudience, expirationTime, claimsSet.getClaims(), token);
    }

    /**
     * Parses and validates a JWT-SVID token and returns an instance of a {@link JwtSvid}.
     * <p>
     * The JWT-SVID signature is not verified.
     *
     * @param token    a token as a string that is parsed and validated
     * @param audience audience as a list of strings used to validate the 'aud' claim
     * @return an instance of a {@link JwtSvid} with a SPIFFE ID parsed from the 'sub', audience from 'aud', and expiry
     * from 'exp' claim.
     * @throws JwtSvidException when the token expired or the expiration claim is missing, or when
     *                                           the 'aud' has an audience that is not in the audience provided as parameter
     * @throws IllegalArgumentException          when the token cannot be parsed
     */
    public static JwtSvid parseInsecure(@NonNull final String token, @NonNull final Set<String> audience) throws JwtSvidException {
        if (StringUtils.isBlank(token)) {
            throw new IllegalArgumentException("Token cannot be blank");
        }

        val signedJwt = getSignedJWT(token);
        val claimsSet = getJwtClaimsSet(signedJwt);

        validateAudience(claimsSet.getAudience(), audience);

        val expirationTime = claimsSet.getExpirationTime();
        validateExpiration(expirationTime);

        val spiffeId = getSpiffeIdOfSubject(claimsSet);

        val claimAudience = new HashSet<>(claimsSet.getAudience());
        return new JwtSvid(spiffeId, claimAudience, expirationTime, claimsSet.getClaims(), token);
    }

    /**
     * Returns the JWT-SVID marshaled to a string. The returned value is the same token value originally passed
     * to the parseAndValidate method.
     *
     * @return the token as String
     */
    public String marshal() {
        return token;
    }

    /**
     * Returns a copy of the expiration date time of the JWT SVID.
     *
     * @return a copy of the expiration date time of the JWT SVID
     */
    public Date getExpiry() {
        // defensive copy to prevent exposing a mutable object
        return new Date(expiry.getTime());
    }

    /**
     * Returns the map of claims.
     *
     * @return the map of claims
     */
    public Map<String, Object> getClaims() {
        return Collections.unmodifiableMap(claims);
    }

    /**
     * Returns the Set of audiences.
     *
     * @return the Set of audiences
     */
    public Set<String> getAudience() {
        return Collections.unmodifiableSet(audience);
    }

    private static JWTClaimsSet getJwtClaimsSet(final SignedJWT signedJwt) {
        final JWTClaimsSet claimsSet;
        try {
            claimsSet = signedJwt.getJWTClaimsSet();
        } catch (ParseException e) {
            throw new IllegalArgumentException("Unable to parse JWT token", e);
        }
        return claimsSet;
    }

    private static SignedJWT getSignedJWT(final String token) {
        final SignedJWT signedJwt;
        try {
            signedJwt = SignedJWT.parse(token);
        } catch (ParseException e) {
            throw new IllegalArgumentException("Unable to parse JWT token", e);
        }
        return signedJwt;
    }

    private static void verifySignature(final SignedJWT signedJwt, final PublicKey jwtAuthority, final String algorithm, final String keyId) throws JwtSvidException {
        boolean verify;
        try {
            val verifier = getJwsVerifier(jwtAuthority, algorithm);
            verify = signedJwt.verify(verifier);
        } catch (ClassCastException | JOSEException e) {
            throw new JwtSvidException(String.format("Error verifying signature with the authority with keyId=%s", keyId), e);
        }

        if (!verify) {
            throw new JwtSvidException(String.format("Signature invalid: cannot be verified with the authority with keyId=%s", keyId));
        }
    }

    private static JWSVerifier getJwsVerifier(final PublicKey jwtAuthority, final String algorithm) throws JOSEException, JwtSvidException {
        JWSVerifier verifier;
        val alg = Algorithm.parse(algorithm);
        if (Algorithm.Family.EC.contains(alg)) {
            verifier = new ECDSAVerifier((ECPublicKey) jwtAuthority);
        } else if (Algorithm.Family.RSA.contains(alg)) {
            verifier = new RSASSAVerifier((RSAPublicKey) jwtAuthority);
        } else {
            throw new JwtSvidException(String.format("Unsupported token signature algorithm %s", algorithm));
        }
        return verifier;
    }

    private static String getKeyId(final JWSHeader header) throws JwtSvidException {
        val keyId = header.getKeyID();
        if (keyId == null) {
            throw new JwtSvidException("Token header missing key id");
        }
        if (StringUtils.isBlank(keyId)) {
            throw new JwtSvidException("Token header key id contains an empty value");
        }
        return keyId;
    }

    private static void validateExpiration(final Date expirationTime) throws JwtSvidException {
        if (expirationTime == null) {
            throw new JwtSvidException("Token missing expiration claim");
        }

        if (expirationTime.before(new Date())) {
            throw new JwtSvidException("Token has expired");
        }
    }

    private static SpiffeId getSpiffeIdOfSubject(final JWTClaimsSet claimsSet) throws JwtSvidException {
        val subject = claimsSet.getSubject();
        if (StringUtils.isBlank(subject)) {
            throw new JwtSvidException("Token missing subject claim");
        }

        try {
            return SpiffeId.parse(subject);
        } catch (IllegalArgumentException e) {
            throw new JwtSvidException(String.format("Subject %s cannot be parsed as a SPIFFE ID", subject), e);
        }

    }

    private static void validateAudience(final List<String> audClaim, final Set<String> expectedAudience) throws JwtSvidException {
        for (String aud : audClaim) {
            if (!expectedAudience.contains(aud)) {
                throw new JwtSvidException(String.format("expected audience in %s (audience=%s)", expectedAudience, audClaim));
            }
        }
    }
}

1	package io.spiffe.svid.jwtsvid;
2
3	import com.nimbusds.jose.JOSEException;
4	import com.nimbusds.jose.JWSHeader;
5	import com.nimbusds.jose.JWSVerifier;
6	import com.nimbusds.jose.crypto.ECDSAVerifier;
7	import com.nimbusds.jose.crypto.RSASSAVerifier;
8	import com.nimbusds.jwt.JWTClaimsSet;
9	import com.nimbusds.jwt.SignedJWT;
10	import io.spiffe.Algorithm;
11	import io.spiffe.bundle.BundleSource;
12	import io.spiffe.bundle.jwtbundle.JwtBundle;
13	import io.spiffe.exception.AuthorityNotFoundException;
14	import io.spiffe.exception.BundleNotFoundException;
15	import io.spiffe.exception.JwtSvidException;
16	import io.spiffe.spiffeid.SpiffeId;
17	import lombok.NonNull;
18	import lombok.Value;
19	import lombok.val;
20	import org.apache.commons.lang3.StringUtils;
21
22	import java.security.PublicKey;
23	import java.security.interfaces.ECPublicKey;
24	import java.security.interfaces.RSAPublicKey;
25	import java.text.ParseException;
26	import java.util.Collections;
27	import java.util.Date;
28	import java.util.HashSet;
29	import java.util.List;
30	import java.util.Map;
31	import java.util.Set;
32
33	/**
34	* Represents a SPIFFE JWT-SVID.
35	*/
36	@Value
37	public class JwtSvid {
38
39	/**
40	* SPIFFE ID of the JWT-SVID as present in the 'sub' claim.
41	*/
42	SpiffeId spiffeId;
43
44	/**
45	* Audience is the intended recipients of JWT-SVID as present in the 'aud' claim.
46	*/
47	Set<String> audience;
48
49	/**
50	* Expiration time of JWT-SVID as present in 'exp' claim.
51	*/
52	Date expiry;
53
54	/**
55	* Parsed claims from token.
56	*/
57	Map<String, Object> claims;
58
59	/**
60	* Serialized JWT token.
61	*/
62	String token;
63
64	private JwtSvid(final SpiffeId spiffeId,
65	final Set<String> audience,
66	final Date expiry,
67	final Map<String, Object> claims,
68	final String token) {	3✔
69	this.spiffeId = spiffeId;	3✔
70	this.audience = audience;	3✔
71	this.expiry = expiry;	3✔
72	this.claims = claims;	3✔
73	this.token = token;	3✔
74	}	3✔
75
76	/**
77	* Parses and validates a JWT-SVID token and returns an instance of {@link JwtSvid}.
78	* <p>
79	* The JWT-SVID signature is verified using the JWT bundle source.
80	*
81	* @param token a token as a string that is parsed and validated
82	* @param jwtBundleSource an implementation of a {@link BundleSource} that provides the JWT authorities to
83	* verify the signature
84	* @param audience audience as a list of strings used to validate the 'aud' claim
85	* @return an instance of a {@link JwtSvid} with a SPIFFE ID parsed from the 'sub', audience from 'aud', and expiry
86	* from 'exp' claim.
87	* @throws JwtSvidException when the token expired or the expiration claim is missing,
88	* when the algorithm is not supported, when the header 'kid' is missing,
89	* when the signature cannot be verified, or
90	* when the 'aud' claim has an audience that is not in the audience list
91	* provided as parameter
92	* @throws IllegalArgumentException when the token is blank or cannot be parsed
93	* @throws BundleNotFoundException if the bundle for the trust domain of the spiffe id from the 'sub'
94	* cannot be found
95	* in the JwtBundleSource
96	* @throws AuthorityNotFoundException if the authority cannot be found in the bundle using the value from
97	* the 'kid' header
98	*/
99	public static JwtSvid parseAndValidate(@NonNull final String token,	3✔
100	@NonNull final BundleSource<JwtBundle> jwtBundleSource,	3✔
101	@NonNull final Set<String> audience)	3✔
102	throws JwtSvidException, BundleNotFoundException, AuthorityNotFoundException {
103
104	if (StringUtils.isBlank(token)) {	3✔
105	throw new IllegalArgumentException("Token cannot be blank");	3✔
106	}
107
108	val signedJwt = getSignedJWT(token);	3✔
109	val claimsSet = getJwtClaimsSet(signedJwt);	3✔
110
111	validateAudience(claimsSet.getAudience(), audience);	3✔
112
113	val expirationTime = claimsSet.getExpirationTime();	3✔
114	validateExpiration(expirationTime);	3✔
115
116	val spiffeId = getSpiffeIdOfSubject(claimsSet);	3✔
117	val jwtBundle = jwtBundleSource.getBundleForTrustDomain(spiffeId.getTrustDomain());	3✔
118
119	val keyId = getKeyId(signedJwt.getHeader());	3✔
120	val jwtAuthority = jwtBundle.findJwtAuthority(keyId);	3✔
121
122	val algorithm = signedJwt.getHeader().getAlgorithm().getName();	3✔
123	verifySignature(signedJwt, jwtAuthority, algorithm, keyId);	3✔
124
125	val claimAudience = new HashSet<>(claimsSet.getAudience());	3✔
126	return new JwtSvid(spiffeId, claimAudience, expirationTime, claimsSet.getClaims(), token);	3✔
127	}
128
129	/**
130	* Parses and validates a JWT-SVID token and returns an instance of a {@link JwtSvid}.
131	* <p>
132	* The JWT-SVID signature is not verified.
133	*
134	* @param token a token as a string that is parsed and validated
135	* @param audience audience as a list of strings used to validate the 'aud' claim
136	* @return an instance of a {@link JwtSvid} with a SPIFFE ID parsed from the 'sub', audience from 'aud', and expiry
137	* from 'exp' claim.
138	* @throws JwtSvidException when the token expired or the expiration claim is missing, or when
139	* the 'aud' has an audience that is not in the audience provided as parameter
140	* @throws IllegalArgumentException when the token cannot be parsed
141	*/
142	public static JwtSvid parseInsecure(@NonNull final String token, @NonNull final Set<String> audience) throws JwtSvidException {	3✔
143	if (StringUtils.isBlank(token)) {	3✔
144	throw new IllegalArgumentException("Token cannot be blank");	3✔
145	}
146
147	val signedJwt = getSignedJWT(token);	3✔
148	val claimsSet = getJwtClaimsSet(signedJwt);	3✔
149
150	validateAudience(claimsSet.getAudience(), audience);	3✔
151
152	val expirationTime = claimsSet.getExpirationTime();	3✔
153	validateExpiration(expirationTime);	3✔
154
155	val spiffeId = getSpiffeIdOfSubject(claimsSet);	3✔
156
157	val claimAudience = new HashSet<>(claimsSet.getAudience());	3✔
158	return new JwtSvid(spiffeId, claimAudience, expirationTime, claimsSet.getClaims(), token);	3✔
159	}
160
161	/**
162	* Returns the JWT-SVID marshaled to a string. The returned value is the same token value originally passed
163	* to the parseAndValidate method.
164	*
165	* @return the token as String
166	*/
167	public String marshal() {
168	return token;	3✔
169	}
170
171	/**
172	* Returns a copy of the expiration date time of the JWT SVID.
173	*
174	* @return a copy of the expiration date time of the JWT SVID
175	*/
176	public Date getExpiry() {
177	// defensive copy to prevent exposing a mutable object
178	return new Date(expiry.getTime());	3✔
179	}
180
181	/**
182	* Returns the map of claims.
183	*
184	* @return the map of claims
185	*/
186	public Map<String, Object> getClaims() {
187	return Collections.unmodifiableMap(claims);	3✔
188	}
189
190	/**
191	* Returns the Set of audiences.
192	*
193	* @return the Set of audiences
194	*/
195	public Set<String> getAudience() {
196	return Collections.unmodifiableSet(audience);	3✔
197	}
198
199	private static JWTClaimsSet getJwtClaimsSet(final SignedJWT signedJwt) {
200	final JWTClaimsSet claimsSet;
201	try {
202	claimsSet = signedJwt.getJWTClaimsSet();	3✔
203	} catch (ParseException e) {	×
204	throw new IllegalArgumentException("Unable to parse JWT token", e);	×
205	}	3✔
206	return claimsSet;	3✔
207	}
208
209	private static SignedJWT getSignedJWT(final String token) {
210	final SignedJWT signedJwt;
211	try {
212	signedJwt = SignedJWT.parse(token);	3✔
213	} catch (ParseException e) {	3✔
214	throw new IllegalArgumentException("Unable to parse JWT token", e);	3✔
215	}	3✔
216	return signedJwt;	3✔
217	}
218
219	private static void verifySignature(final SignedJWT signedJwt, final PublicKey jwtAuthority, final String algorithm, final String keyId) throws JwtSvidException {
220	boolean verify;
221	try {
222	val verifier = getJwsVerifier(jwtAuthority, algorithm);	3✔
223	verify = signedJwt.verify(verifier);	3✔
224	} catch (ClassCastException \| JOSEException e) {	3✔
225	throw new JwtSvidException(String.format("Error verifying signature with the authority with keyId=%s", keyId), e);	3✔
226	}	3✔
227
228	if (!verify) {	3✔
229	throw new JwtSvidException(String.format("Signature invalid: cannot be verified with the authority with keyId=%s", keyId));	3✔
230	}
231	}	3✔
232
233	private static JWSVerifier getJwsVerifier(final PublicKey jwtAuthority, final String algorithm) throws JOSEException, JwtSvidException {
234	JWSVerifier verifier;
235	val alg = Algorithm.parse(algorithm);	3✔
236	if (Algorithm.Family.EC.contains(alg)) {	3✔
237	verifier = new ECDSAVerifier((ECPublicKey) jwtAuthority);	3✔
238	} else if (Algorithm.Family.RSA.contains(alg)) {	3✔
239	verifier = new RSASSAVerifier((RSAPublicKey) jwtAuthority);	3✔
240	} else {
241	throw new JwtSvidException(String.format("Unsupported token signature algorithm %s", algorithm));	3✔
242	}
243	return verifier;	3✔
244	}
245
246	private static String getKeyId(final JWSHeader header) throws JwtSvidException {
247	val keyId = header.getKeyID();	3✔
248	if (keyId == null) {	3✔
249	throw new JwtSvidException("Token header missing key id");	3✔
250	}
251	if (StringUtils.isBlank(keyId)) {	3✔
252	throw new JwtSvidException("Token header key id contains an empty value");	3✔
253	}
254	return keyId;	3✔
255	}
256
257	private static void validateExpiration(final Date expirationTime) throws JwtSvidException {
258	if (expirationTime == null) {	3✔
259	throw new JwtSvidException("Token missing expiration claim");	3✔
260	}
261
262	if (expirationTime.before(new Date())) {	3✔
263	throw new JwtSvidException("Token has expired");	3✔
264	}
265	}	3✔
266
267	private static SpiffeId getSpiffeIdOfSubject(final JWTClaimsSet claimsSet) throws JwtSvidException {
268	val subject = claimsSet.getSubject();	3✔
269	if (StringUtils.isBlank(subject)) {	3✔
270	throw new JwtSvidException("Token missing subject claim");	3✔
271	}
272
273	try {
274	return SpiffeId.parse(subject);	3✔
275	} catch (IllegalArgumentException e) {	3✔
276	throw new JwtSvidException(String.format("Subject %s cannot be parsed as a SPIFFE ID", subject), e);	3✔
277	}
278
279	}
280
281	private static void validateAudience(final List<String> audClaim, final Set<String> expectedAudience) throws JwtSvidException {
282	for (String aud : audClaim) {	3✔
283	if (!expectedAudience.contains(aud)) {	3✔
284	throw new JwtSvidException(String.format("expected audience in %s (audience=%s)", expectedAudience, audClaim));	3✔
285	}
286	}	3✔
287	}	3✔
288	}

spiffe / java-spiffe / 79

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous