GRPC Core  0.10.0.0
 All Data Structures Files Functions Variables Typedefs Enumerations Enumerator Macros Pages
jwt_verifier.h
Go to the documentation of this file.
1 /*
2  *
3  * Copyright 2015, Google Inc.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions are
8  * met:
9  *
10  * * Redistributions of source code must retain the above copyright
11  * notice, this list of conditions and the following disclaimser.
12  * * Redistributions in binary form must reproduce the above
13  * copyright notice, this list of conditions and the following disclaimser
14  * in the documentation and/or other materials provided with the
15  * distribution.
16  * * Neither the name of Google Inc. nor the names of its
17  * contributors may be used to endorse or promote products derived from
18  * this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
26  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  */
33 
34 #ifndef GRPC_INTERNAL_CORE_SECURITY_JWT_VERIFIER_H
35 #define GRPC_INTERNAL_CORE_SECURITY_JWT_VERIFIER_H
36 
37 #include "src/core/iomgr/pollset.h"
38 #include "src/core/json/json.h"
39 
40 #include <grpc/support/slice.h>
41 #include <grpc/support/time.h>
42 
43 /* --- Constants. --- */
44 
45 #define GRPC_OPENID_CONFIG_URL_SUFFIX "/.well-known/openid-configuration"
46 #define GRPC_GOOGLE_SERVICE_ACCOUNTS_EMAIL_DOMAIN \
47  "developer.gserviceaccount.com"
48 #define GRPC_GOOGLE_SERVICE_ACCOUNTS_KEY_URL_PREFIX \
49  "www.googleapis.com/robot/v1/metadata/x509"
50 
51 /* --- grpc_jwt_verifier_status. --- */
52 
53 typedef enum {
62 
64 
65 /* --- grpc_jwt_claims. --- */
66 
68 
70 
71 /* Returns the whole JSON tree of the claims. */
72 const grpc_json *grpc_jwt_claims_json(const grpc_jwt_claims *claims);
73 
74 /* Access to registered claims in https://tools.ietf.org/html/rfc7519#page-9 */
75 const char *grpc_jwt_claims_subject(const grpc_jwt_claims *claims);
76 const char *grpc_jwt_claims_issuer(const grpc_jwt_claims *claims);
77 const char *grpc_jwt_claims_id(const grpc_jwt_claims *claims);
78 const char *grpc_jwt_claims_audience(const grpc_jwt_claims *claims);
82 
83 /* --- grpc_jwt_verifier. --- */
84 
86 
87 typedef struct {
88  /* The email domain is the part after the @ sign. */
89  const char *email_domain;
90 
91  /* The key url prefix will be used to get the public key from the issuer:
92  https://<key_url_prefix>/<issuer_email>
93  Therefore the key_url_prefix must NOT contain https://. */
94  const char *key_url_prefix;
96 
97 /* Globals to control the verifier. Not thread-safe. */
100 
101 /* The verifier can be created with some custom mappings to help with key
102  discovery in the case where the issuer is an email address.
103  mappings can be NULL in which case num_mappings MUST be 0.
104  A verifier object has one built-in mapping (unless overridden):
105  GRPC_GOOGLE_SERVICE_ACCOUNTS_EMAIL_DOMAIN ->
106  GRPC_GOOGLE_SERVICE_ACCOUNTS_KEY_URL_PREFIX.*/
109  size_t num_mappings);
110 
111 /*The verifier must not be destroyed if there are still outstanding callbacks.*/
113 
114 /* User provided callback that will be called when the verification of the JWT
115  is done (maybe in another thread).
116  It is the responsibility of the callee to call grpc_jwt_claims_destroy on
117  the claims. */
118 typedef void (*grpc_jwt_verification_done_cb)(void *user_data,
120  grpc_jwt_claims *claims);
121 
122 /* Verifies for the JWT for the given expected audience. */
124  grpc_pollset *pollset, const char *jwt,
125  const char *audience,
127  void *user_data);
128 
129 /* --- TESTING ONLY exposed functions. --- */
130 
133  const char *audience);
134 
135 #endif /* GRPC_INTERNAL_CORE_SECURITY_JWT_VERIFIER_H */
136 
const char * grpc_jwt_claims_subject(const grpc_jwt_claims *claims)
Definition: jwt_verifier.c:203
void grpc_jwt_verifier_verify(grpc_jwt_verifier *verifier, grpc_pollset *pollset, const char *jwt, const char *audience, grpc_jwt_verification_done_cb cb, void *user_data)
Definition: jwt_verifier.c:754
void(* grpc_jwt_verification_done_cb)(void *user_data, grpc_jwt_verifier_status status, grpc_jwt_claims *claims)
Definition: jwt_verifier.h:118
const char * grpc_jwt_verifier_status_to_string(grpc_jwt_verifier_status status)
Definition: jwt_verifier.c:49
grpc_jwt_verifier_status
Definition: jwt_verifier.h:53
const char * grpc_jwt_claims_audience(const grpc_jwt_claims *claims)
Definition: jwt_verifier.c:218
Definition: jwt_verifier.c:375
Definition: jwt_verifier.h:54
gpr_timespec grpc_jwt_claims_issued_at(const grpc_jwt_claims *claims)
Definition: jwt_verifier.c:223
Definition: jwt_verifier.h:58
void grpc_jwt_verifier_destroy(grpc_jwt_verifier *verifier)
Definition: jwt_verifier.c:823
Definition: pollset_posix.h:48
grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims *claims, const char *audience)
Definition: jwt_verifier.c:284
Definition: jwt_verifier.h:55
grpc_jwt_claims * grpc_jwt_claims_from_json(grpc_json *json, gpr_slice buffer)
Definition: jwt_verifier.c:239
const char * grpc_jwt_claims_id(const grpc_jwt_claims *claims)
Definition: jwt_verifier.c:213
Definition: jwt_verifier.h:60
Definition: jwt_verifier.c:178
Definition: jwt_verifier.h:59
void grpc_jwt_claims_destroy(grpc_jwt_claims *claims)
Definition: jwt_verifier.c:192
gpr_timespec grpc_jwt_verifier_clock_skew
Definition: jwt_verifier.c:365
Definition: json.h:44
Definition: jwt_verifier.h:56
const char * email_domain
Definition: jwt_verifier.h:89
gpr_timespec grpc_jwt_claims_not_before(const grpc_jwt_claims *claims)
Definition: jwt_verifier.c:233
Definition: jwt_verifier.h:57
Definition: time.h:60
const grpc_json * grpc_jwt_claims_json(const grpc_jwt_claims *claims)
Definition: jwt_verifier.c:198
const char * grpc_jwt_claims_issuer(const grpc_jwt_claims *claims)
Definition: jwt_verifier.c:208
const char * key_url_prefix
Definition: jwt_verifier.h:94
Definition: slice.h:79
grpc_jwt_verifier * grpc_jwt_verifier_create(const grpc_jwt_verifier_email_domain_key_url_mapping *mappings, size_t num_mappings)
Definition: jwt_verifier.c:800
gpr_timespec grpc_jwt_verifier_max_delay
Definition: jwt_verifier.c:368
gpr_timespec grpc_jwt_claims_expires_at(const grpc_jwt_claims *claims)
Definition: jwt_verifier.c:228