Package org.forgerock.openig.fapi.certificate

Class TransportCertValidator

java.lang.Object

org.forgerock.openig.fapi.certificate.TransportCertValidator

public class TransportCertValidator
extends Object

Certificate validation is achieved by comparing the incoming client certificate with those obtained from the client JWKSet. That is, we obtain valid certificates for the expected purpose from the JWKSet and compare the client certificate with these certificates to find a match.

For the FAPI use case, the JWK.use value is expected to be "tls" for a cert that is used for MTLS purposes. This is a custom key use defined by Open Banking that we have decided to consider to be standard in the absence of a FAPI specification, and until other standards surface that may require other key uses.

See Also:

• Open Banking key uses // @Checkstyle:off LineLength
• Open Banking Certificate Lookup // @Checkstyle:on LineLength

Constructor Summary

Constructors

Constructor	Description
TransportCertValidator()

Method Summary

Modifier and Type	Method	Description
Promise<Void,CertificateException>	validate(X509Certificate tlsClientCert, JwkSetSecretStore jwkSetSecretStore)	Validate the clientCertificate against the JWKS obtained from the jwkSetSecretStore.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

TransportCertValidator

public TransportCertValidator()

Method Details

validate

public Promise<Void,CertificateException> validate(X509Certificate tlsClientCert,
 JwkSetSecretStore jwkSetSecretStore)

Validate the clientCertificate against the JWKS obtained from the jwkSetSecretStore. The result promise will contain a CertificateException if there is no secret matching the certificate.

Parameters:

tlsClientCert - client's X509Certificate MTLS certificate to validate

jwkSetSecretStore - JwkSetSecretStore containing the client's keys to validate against

Returns:

a Promise containing an empty result on success, or a CertificateException if the certificate is not valid (as per the original API)