@Beta public class IdTokenVerifier extends Object
Beta
Call verify(IdToken)
to verify a ID token. This is a light-weight object, so you may use
a new instance for each configuration of expected issuer and trusted client IDs. Sample usage:
IdTokenVerifier verifier = new IdTokenVerifier.Builder() .setIssuer("issuer.example.com") .setAudience(Arrays.asList("myClientId")) .build(); ... if (!verifier.verify(idToken)) {...}
Note that verify(IdToken)
only implements a subset of the verification steps, mostly
just the MUST steps. Please read Since:
Modifier and Type | Class | Description |
---|---|---|
static class |
IdTokenVerifier.Builder |
Modifier and Type | Field | Description |
---|---|---|
static long |
DEFAULT_TIME_SKEW_SECONDS |
Default value for seconds of time skew to accept when verifying time (5 minutes).
|
Modifier | Constructor | Description |
---|---|---|
|
IdTokenVerifier() |
|
protected |
IdTokenVerifier(IdTokenVerifier.Builder builder) |
Modifier and Type | Method | Description |
---|---|---|
long |
getAcceptableTimeSkewSeconds() |
Returns the seconds of time skew to accept when verifying time.
|
Collection<String> |
getAudience() |
Returns the unmodifiable list of trusted audience client IDs or
null to suppress the
audience check. |
com.google.api.client.util.Clock |
getClock() |
Returns the clock.
|
String |
getIssuer() |
Returns the first of equivalent expected issuers or
null if issuer check suppressed. |
Collection<String> |
getIssuers() |
Returns the equivalent expected issuers or
null if issuer check suppressed. |
boolean |
verify(IdToken idToken) |
Verifies that the given ID token is valid using the cached public keys.
|
public static final long DEFAULT_TIME_SKEW_SECONDS
public IdTokenVerifier()
protected IdTokenVerifier(IdTokenVerifier.Builder builder)
builder
- builderpublic final com.google.api.client.util.Clock getClock()
public final long getAcceptableTimeSkewSeconds()
public final String getIssuer()
null
if issuer check suppressed.public final Collection<String> getIssuers()
null
if issuer check suppressed.public final Collection<String> getAudience()
null
to suppress the
audience check.public boolean verify(IdToken idToken)
getIssuers()
by calling IdToken.verifyIssuer(String)
.getAudience()
by calling
IdToken.verifyAudience(Collection)
.getClock()
and allowing for a time skew specified in {#link getAcceptableTimeSkewSeconds()
, by
calling IdToken.verifyTime(long, long)
.Overriding is allowed, but it must call the super implementation.
idToken
- ID tokentrue
if verified successfully or false
if failedCopyright © 2011–2019 Google. All rights reserved.