jwks

README

jwks

The scope of this package is to implement just enough of the JWKS specification to read a JWKS via HTTP and validate JWTs via compatible functions. Validating is done through github.com/dgrijalva/jwt-go. This package helps by exporting a jwt.KeyFunc.

Currently, this package only supports JWTs signed with the alg of RS256 (for Keycloak).

Example

TODO

TODO

• Make an example in the README.md.
• Add other signature algorithms. It appears Keycloak supports this with the Tokens tab.

Documentation

Index

• Constants
• Variables
• type JSONKey
  • func (j *JSONKey) RSA() (publicKey *rsa.PublicKey, err error)
• type Keystore
  • func Get(ctx context.Context, client *http.Client, jwksURL string) (keystore Keystore, err error)
  • func New(keystoreBytes json.RawMessage) (keystore Keystore, err error)
  • func (k Keystore) KeyFunc() (keyFunc jwt.Keyfunc)
  • func (k Keystore) RSA(kid string) (publicKey *rsa.PublicKey, err error)

Constants

const (

	// RS256 represents a cryptography key generated by an RSA algorithm.
	RS256 = "RS256"
)

Variables

var (

	// ErrKIDNotFound indicates that the given key ID was not found in the JWKS.
	ErrKIDNotFound = errors.New("the given key ID was not found in the JWKS")

	// ErrNotExpectedKeyType indicates that the given public key was not of the expected type.
	ErrNotExpectedKeyType = errors.New("the public key was not of the expected type")
)

var (

	// ErrUnsupportedKeyType indicates the JWT key type is an unsupported type.
	ErrUnsupportedKeyType = errors.New("the JWT key type is unsupported")
)

Types

type JSONKey

type JSONKey struct {
	Exponent string `json:"e"`
	ID       string `json:"kid"`
	Alg      string `json:"alg"`
	Modulus  string `json:"n"`
	// contains filtered or unexported fields
}

JSONKey represents a raw key inside a JWKS.

func (*JSONKey) RSA

func (j *JSONKey) RSA() (publicKey *rsa.PublicKey, err error)

RSA parses a JSONKey and turns it into an RSA public key.

type Keystore

type Keystore map[string]*JSONKey

Keystore represents a JWKS.

func Get

func Get(ctx context.Context, client *http.Client, jwksURL string) (keystore Keystore, err error)

Get loads the JWKS at the given URL.

func New

func New(keystoreBytes json.RawMessage) (keystore Keystore, err error)

New creates a new JWKS from a raw JSON message.

func (Keystore) KeyFunc

func (k Keystore) KeyFunc() (keyFunc jwt.Keyfunc)

KeyFunc is a compatibility function that matches the signature of github.com/dgrijalva/jwt-go's KeyFunc function.

func (Keystore) RSA

func (k Keystore) RSA(kid string) (publicKey *rsa.PublicKey, err error)

RSA retrieves an RSA public key from the JWKS.