How to Validate a JWT with a JWK (ColdFusion)How do I efficiently iterate over each entry in a Java Map?How do I call one constructor from another in Java?How do I read / convert an InputStream into a String in Java?How do I generate random integers within a specific range in Java?How can I create an executable JAR with dependencies using Maven?How to get an enum value from a string value in Java?How do I determine whether an array contains a particular value in Java?How to pass “Null” (a real surname!) to a SOAP web service in ActionScript 3?How do I convert a String to an int in Java?How do I fix android.os.NetworkOnMainThreadException?
What is the meaning of "it" in "as luck would have it"?
Which are more efficient in putting out wildfires: planes or helicopters?
SQL Server Ignoring Instance name when using port number of different instance
My mom helped me cosign a car and now she wants to take it
How useful would a hydroelectric power plant be in the post-apocalypse world?
Was Wolfgang Unziker the last Amateur GM?
Why should I allow multiple IP addresses on a website for a single session?
What prevents a US state from colonizing a smaller state?
Square wave to sawtooth wave using two BJT
Why can't i use !(single pattern) in zsh even after i turn on kshglob?
Why was Pan Am Flight 103 flying over Lockerbie?
Crop production in mountains?
What happens if a caster is surprised while casting a spell with a long casting time?
"Best practices" for formulating MIPs
Is it OK to say "The situation is pregnant with a crisis"?
How can I smooth the top side of this ring?
Why are symbols not written in words?
Advantages of using bra-ket notation
Why is the saxophone not common in classical repertoire?
How can solar sailed ships be protected from space debris?
I agreed to cancel a long-planned vacation (with travel costs) due to project deadlines, but now the timeline has all changed again
Using quotation marks and exclamation marks
Why will we fail creating a self sustaining off world colony?
What caused the flashes in the video footage of Chernobyl?
How to Validate a JWT with a JWK (ColdFusion)
How do I efficiently iterate over each entry in a Java Map?How do I call one constructor from another in Java?How do I read / convert an InputStream into a String in Java?How do I generate random integers within a specific range in Java?How can I create an executable JAR with dependencies using Maven?How to get an enum value from a string value in Java?How do I determine whether an array contains a particular value in Java?How to pass “Null” (a real surname!) to a SOAP web service in ActionScript 3?How do I convert a String to an int in Java?How do I fix android.os.NetworkOnMainThreadException?
I am currently trying to verify the signature of a JWT using an RSA public key built from a JWKS URL. I am using some Java objects for this, but my problem is that the Java Signature verifier doesn't just take a plain-text string decoded to binary as an argument, it takes it's own proprietary binary decoded "signature".
So I'm just wondering what I can do to convert my plain text signature into the data-type the Java Signature verify() function expects.
Here is my current code:
private function validate_jwt_signature(rc)
var id_token = listToArray(rc.id_token, ".");
if (listToArray(id_token[2], "")[len(id_token[2])] != "=")
id_token[2] = id_token[2] & "=";
var header = deserializeJSON(base64urldecode(id_token[1]));
var payload = deserializeJSON(base64urldecode(id_token[2]));
var body = id_token[1] & "." & id_token[2];
var signature = id_token[3];
cfhttp(url="https://lti-ri.imsglobal.org/platforms/53/platform_keys/48.json", method="GET", result="key");
var platformPubKey = deserializeJSON(key.filecontent).keys[1].n;
createObject( "java", "java.security.Security" )
.addProvider( createObject( "java", "org.bouncycastle.jce.provider.BouncyCastleProvider" ).init());
var platformPubKey = reReplace( platformPubKey, "-", "+", "all" );
var platformPubKey = reReplace( platformPubKey, "_", "/", "all" );
var pemKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA" & platformPubKey & "IDAQAB";
var publicKeySpec = createObject( "java", "java.security.spec.X509EncodedKeySpec" )
.init(binaryDecode( pemKey, "base64" ));
var publicKey = createObject( "java", "java.security.KeyFactory" )
.getInstance( javaCast( "string", "RSA" ) )
.generatePublic( publicKeySpec );
var verifier = createObject( "java", "java.security.Signature" )
.getInstance( javaCast( "string", 'SHA256withRSA' ));
var verifier.initVerify( publicKey );
var verifier.update( charsetDecode( body, "utf-8" ) );
var signature = reReplace( signature, "-", "+", "all" );
var signature = reReplace( signature, "_", "/", "all" );
var verified = verifier.verify( charsetDecode(signature, "utf-8"));
return verified;
This code runs and does not error, but it always returns false even when I know the signature is valid.
java coldfusion jwt cfml coldbox
edited Mar 25 at 17:38
Miguel-F
12.3k4 gold badges26 silver badges48 bronze badges
asked Mar 25 at 16:57
Haeven KelleyHaeven Kelley
162 bronze badges
add a comment |
I am currently trying to verify the signature of a JWT using an RSA public key built from a JWKS URL. I am using some Java objects for this, but my problem is that the Java Signature verifier doesn't just take a plain-text string decoded to binary as an argument, it takes it's own proprietary binary decoded "signature".
So I'm just wondering what I can do to convert my plain text signature into the data-type the Java Signature verify() function expects.
Here is my current code:
private function validate_jwt_signature(rc)
var id_token = listToArray(rc.id_token, ".");
if (listToArray(id_token[2], "")[len(id_token[2])] != "=")
id_token[2] = id_token[2] & "=";
var header = deserializeJSON(base64urldecode(id_token[1]));
var payload = deserializeJSON(base64urldecode(id_token[2]));
var body = id_token[1] & "." & id_token[2];
var signature = id_token[3];
cfhttp(url="https://lti-ri.imsglobal.org/platforms/53/platform_keys/48.json", method="GET", result="key");
var platformPubKey = deserializeJSON(key.filecontent).keys[1].n;
createObject( "java", "java.security.Security" )
.addProvider( createObject( "java", "org.bouncycastle.jce.provider.BouncyCastleProvider" ).init());
var platformPubKey = reReplace( platformPubKey, "-", "+", "all" );
var platformPubKey = reReplace( platformPubKey, "_", "/", "all" );
var pemKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA" & platformPubKey & "IDAQAB";
var publicKeySpec = createObject( "java", "java.security.spec.X509EncodedKeySpec" )
.init(binaryDecode( pemKey, "base64" ));
var publicKey = createObject( "java", "java.security.KeyFactory" )
.getInstance( javaCast( "string", "RSA" ) )
.generatePublic( publicKeySpec );
var verifier = createObject( "java", "java.security.Signature" )
.getInstance( javaCast( "string", 'SHA256withRSA' ));
var verifier.initVerify( publicKey );
var verifier.update( charsetDecode( body, "utf-8" ) );
var signature = reReplace( signature, "-", "+", "all" );
var signature = reReplace( signature, "_", "/", "all" );
var verified = verifier.verify( charsetDecode(signature, "utf-8"));
return verified;
This code runs and does not error, but it always returns false even when I know the signature is valid.
java coldfusion jwt cfml coldbox
edited Mar 25 at 17:38
Miguel-F
12.3k4 gold badges26 silver badges48 bronze badges
asked Mar 25 at 16:57
Haeven KelleyHaeven Kelley
162 bronze badges
1
It is needed to provided the binary signature to the verifier. Useverifier.verify(Base64.getUrlDecoder().decode(signature));. To avoid errors, you can construct the public key usingnew RSAPublicKeySpec (modulus, pubExp)instead of manually building a PEM key (I do not know if your code works)
– pedrofb
Mar 25 at 21:01
Good spot. I noticed all the replace() statements and was just going to ask if the signature was base64 encoded. If it is, usebinaryDecode(signature, "base64")instead ofcharsetDecode().
– Ageax
Mar 25 at 21:11
add a comment |
I am currently trying to verify the signature of a JWT using an RSA public key built from a JWKS URL. I am using some Java objects for this, but my problem is that the Java Signature verifier doesn't just take a plain-text string decoded to binary as an argument, it takes it's own proprietary binary decoded "signature".
So I'm just wondering what I can do to convert my plain text signature into the data-type the Java Signature verify() function expects.
Here is my current code:
private function validate_jwt_signature(rc)
var id_token = listToArray(rc.id_token, ".");
if (listToArray(id_token[2], "")[len(id_token[2])] != "=")
id_token[2] = id_token[2] & "=";
var header = deserializeJSON(base64urldecode(id_token[1]));
var payload = deserializeJSON(base64urldecode(id_token[2]));
var body = id_token[1] & "." & id_token[2];
var signature = id_token[3];
cfhttp(url="https://lti-ri.imsglobal.org/platforms/53/platform_keys/48.json", method="GET", result="key");
var platformPubKey = deserializeJSON(key.filecontent).keys[1].n;
createObject( "java", "java.security.Security" )
.addProvider( createObject( "java", "org.bouncycastle.jce.provider.BouncyCastleProvider" ).init());
var platformPubKey = reReplace( platformPubKey, "-", "+", "all" );
var platformPubKey = reReplace( platformPubKey, "_", "/", "all" );
var pemKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA" & platformPubKey & "IDAQAB";
var publicKeySpec = createObject( "java", "java.security.spec.X509EncodedKeySpec" )
.init(binaryDecode( pemKey, "base64" ));
var publicKey = createObject( "java", "java.security.KeyFactory" )
.getInstance( javaCast( "string", "RSA" ) )
.generatePublic( publicKeySpec );
var verifier = createObject( "java", "java.security.Signature" )
.getInstance( javaCast( "string", 'SHA256withRSA' ));
var verifier.initVerify( publicKey );
var verifier.update( charsetDecode( body, "utf-8" ) );
var signature = reReplace( signature, "-", "+", "all" );
var signature = reReplace( signature, "_", "/", "all" );
var verified = verifier.verify( charsetDecode(signature, "utf-8"));
return verified;
This code runs and does not error, but it always returns false even when I know the signature is valid.
java coldfusion jwt cfml coldbox
edited Mar 25 at 17:38
Miguel-F
12.3k4 gold badges26 silver badges48 bronze badges
asked Mar 25 at 16:57
Haeven KelleyHaeven Kelley
162 bronze badges
I am currently trying to verify the signature of a JWT using an RSA public key built from a JWKS URL. I am using some Java objects for this, but my problem is that the Java Signature verifier doesn't just take a plain-text string decoded to binary as an argument, it takes it's own proprietary binary decoded "signature".
So I'm just wondering what I can do to convert my plain text signature into the data-type the Java Signature verify() function expects.
Here is my current code:
private function validate_jwt_signature(rc)
var id_token = listToArray(rc.id_token, ".");
if (listToArray(id_token[2], "")[len(id_token[2])] != "=")
id_token[2] = id_token[2] & "=";
var header = deserializeJSON(base64urldecode(id_token[1]));
var payload = deserializeJSON(base64urldecode(id_token[2]));
var body = id_token[1] & "." & id_token[2];
var signature = id_token[3];
cfhttp(url="https://lti-ri.imsglobal.org/platforms/53/platform_keys/48.json", method="GET", result="key");
var platformPubKey = deserializeJSON(key.filecontent).keys[1].n;
createObject( "java", "java.security.Security" )
.addProvider( createObject( "java", "org.bouncycastle.jce.provider.BouncyCastleProvider" ).init());
var platformPubKey = reReplace( platformPubKey, "-", "+", "all" );
var platformPubKey = reReplace( platformPubKey, "_", "/", "all" );
var pemKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA" & platformPubKey & "IDAQAB";
var publicKeySpec = createObject( "java", "java.security.spec.X509EncodedKeySpec" )
.init(binaryDecode( pemKey, "base64" ));
var publicKey = createObject( "java", "java.security.KeyFactory" )
.getInstance( javaCast( "string", "RSA" ) )
.generatePublic( publicKeySpec );
var verifier = createObject( "java", "java.security.Signature" )
.getInstance( javaCast( "string", 'SHA256withRSA' ));
var verifier.initVerify( publicKey );
var verifier.update( charsetDecode( body, "utf-8" ) );
var signature = reReplace( signature, "-", "+", "all" );
var signature = reReplace( signature, "_", "/", "all" );
var verified = verifier.verify( charsetDecode(signature, "utf-8"));
return verified;
This code runs and does not error, but it always returns false even when I know the signature is valid.
java coldfusion jwt cfml coldbox
java coldfusion jwt cfml coldbox
edited Mar 25 at 17:38
Miguel-F
12.3k4 gold badges26 silver badges48 bronze badges
asked Mar 25 at 16:57
Haeven KelleyHaeven Kelley
162 bronze badges
edited Mar 25 at 17:38
Miguel-F
12.3k4 gold badges26 silver badges48 bronze badges
asked Mar 25 at 16:57
Haeven KelleyHaeven Kelley
162 bronze badges
edited Mar 25 at 17:38
Miguel-F
12.3k4 gold badges26 silver badges48 bronze badges
edited Mar 25 at 17:38
Miguel-F
12.3k4 gold badges26 silver badges48 bronze badges
edited Mar 25 at 17:38
Miguel-F
12.3k4 gold badges26 silver badges48 bronze badges
12.3k4 gold badges26 silver badges48 bronze badges
asked Mar 25 at 16:57
Haeven KelleyHaeven Kelley
162 bronze badges
asked Mar 25 at 16:57
Haeven KelleyHaeven Kelley
162 bronze badges
asked Mar 25 at 16:57
Haeven KelleyHaeven Kelley
162 bronze badges
162 bronze badges
1
It is needed to provided the binary signature to the verifier. Useverifier.verify(Base64.getUrlDecoder().decode(signature));. To avoid errors, you can construct the public key usingnew RSAPublicKeySpec (modulus, pubExp)instead of manually building a PEM key (I do not know if your code works)
– pedrofb
Mar 25 at 21:01
Good spot. I noticed all the replace() statements and was just going to ask if the signature was base64 encoded. If it is, usebinaryDecode(signature, "base64")instead ofcharsetDecode().
– Ageax
Mar 25 at 21:11
add a comment |
1
It is needed to provided the binary signature to the verifier. Useverifier.verify(Base64.getUrlDecoder().decode(signature));. To avoid errors, you can construct the public key usingnew RSAPublicKeySpec (modulus, pubExp)instead of manually building a PEM key (I do not know if your code works)
– pedrofb
Mar 25 at 21:01
Good spot. I noticed all the replace() statements and was just going to ask if the signature was base64 encoded. If it is, usebinaryDecode(signature, "base64")instead ofcharsetDecode().
– Ageax
Mar 25 at 21:11
1
1
It is needed to provided the binary signature to the verifier. Use
verifier.verify(Base64.getUrlDecoder().decode(signature));. To avoid errors, you can construct the public key using new RSAPublicKeySpec (modulus, pubExp) instead of manually building a PEM key (I do not know if your code works)– pedrofb
Mar 25 at 21:01
It is needed to provided the binary signature to the verifier. Use
verifier.verify(Base64.getUrlDecoder().decode(signature));. To avoid errors, you can construct the public key using new RSAPublicKeySpec (modulus, pubExp) instead of manually building a PEM key (I do not know if your code works)– pedrofb
Mar 25 at 21:01
Good spot. I noticed all the replace() statements and was just going to ask if the signature was base64 encoded. If it is, use
binaryDecode(signature, "base64") instead of charsetDecode().– Ageax
Mar 25 at 21:11
Good spot. I noticed all the replace() statements and was just going to ask if the signature was base64 encoded. If it is, use
binaryDecode(signature, "base64") instead of charsetDecode().– Ageax
Mar 25 at 21:11
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55342905%2fhow-to-validate-a-jwt-with-a-jwk-coldfusion%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Is this question similar to what you get asked at work? Learn more about asking and sharing private information with your coworkers using Stack Overflow for Teams.
Is this question similar to what you get asked at work? Learn more about asking and sharing private information with your coworkers using Stack Overflow for Teams.
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55342905%2fhow-to-validate-a-jwt-with-a-jwk-coldfusion%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
It is needed to provided the binary signature to the verifier. Use
verifier.verify(Base64.getUrlDecoder().decode(signature));. To avoid errors, you can construct the public key usingnew RSAPublicKeySpec (modulus, pubExp)instead of manually building a PEM key (I do not know if your code works)– pedrofb
Mar 25 at 21:01
Good spot. I noticed all the replace() statements and was just going to ask if the signature was base64 encoded. If it is, use
binaryDecode(signature, "base64")instead ofcharsetDecode().– Ageax
Mar 25 at 21:11