libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

KEYCLOAK-5257 Clarify usage of TokenVerifier

Browse source
This commit is contained in:
Hynek Mlnarik 2018-07-25 14:40:10 +02:00 committed by Hynek Mlnařík
parent 29da7d3d90
commit f57cc3a9c0
2 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
core/src/main/java/org/keycloak/TokenVerifier.java
View file

@ -167,12 +167,15 @@ public class TokenVerifier<T extends JsonWebToken> {
} }
/** /**
* Creates an instance of {@code TokenVerifier} from the given string on a JWT of the given class. * Creates an instance of {@code TokenVerifier} for the given token.
* The token verifier has no checks defined. Note that the checks are only tested when * The token verifier has no checks defined. Note that the checks are only tested when
* {@link #verify()} method is invoked. * {@link #verify()} method is invoked.
* <p>
* <b>NOTE:</b> The returned token verifier cannot verify token signature since
* that is not part of the {@link JsonWebToken} object.
* @return * @return
*/ */
public static <T extends JsonWebToken> TokenVerifier<T> create(T token) { public static <T extends JsonWebToken> TokenVerifier<T> createWithoutSignature(T token) {
return new TokenVerifier(token); return new TokenVerifier(token);
} }

2
services/src/main/java/org/keycloak/services/resources/LoginActionsService.java
View file

@ -544,7 +544,7 @@ public class LoginActionsService {
session.getContext().setClient(authSession.getClient()); session.getContext().setClient(authSession.getClient());
TokenVerifier.create(token) TokenVerifier.createWithoutSignature(token)
.withChecks(handler.getVerifiers(tokenContext)) .withChecks(handler.getVerifiers(tokenContext))
.verify(); .verify();