Authentication sample using OIDC ID token¶

/**
 * Provides the function to verify the validity of ID token issued by Cognito.
 */
public class CognitoIdTokenVerifier implements IdTokenVerifier {

    /** Region */
    private String region;

    /** User pool ID */
    private String userPoolId;

    /** Client ID */
    private String clientId;

    /** Signature Algorithm Provider */
    private SignatureAlgorithmProvider signatureAlgorithmProvider;

    @Override
    public DecodedJWT verify(String idToken) throws JWTVerificationException {
        // Follow Cognito's guide on how to verify a token is valid.
        //   https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html
        // Assuming that the ID token is sent immediately after acquisition on the front-end, the allowed duration of validity is 60 seconds.
        JWTVerifier verifier = JWT.require(signatureAlgorithmProvider.get())
                .acceptExpiresAt(60)
                .withAudience(clientId)
                .withIssuer(createUserPoolUrl(region, userPoolId))
                .withClaim("token_use", "id")
                .build();
        return verifier.verify(idToken);
    }

    /**
     * Create a URL for the User pool.
     *
     * @param region Region
     * @param userPoolId User pool ID
     * @return URL of the User pool
     */
    private String createUserPoolUrl(String region, String userPoolId) {
        return "https://cognito-idp." + region + ".amazonaws.com/" + userPoolId;
    }
    ...
}

/**
 * Provides the algorithm used for signature verification of tokens issued by Cognito.
 */
public class CognitoSignatureAlgorithmProvider implements SignatureAlgorithmProvider {

    /** RSA Public Key Provider */
    private RSAKeyProvider rsaKeyProvider;

    @Override
    public Algorithm get() {
        return Algorithm.RSA256(rsaKeyProvider);
    }
    ...
}

/**
 * Provides RSA public key used to verify token issued by Cognito.
 */
public class CognitoRSAKeyProvider implements RSAKeyProvider, Initializable {

    /** Region */
    private String region;

    /** User pool ID */
    private String userPoolId;

    /** JWK Provider */
    private JwkProvider provider;

    @Override
    public RSAPublicKey getPublicKeyById(String keyId) {
        try {
            Jwk jwk = provider.get(keyId);
            return (RSAPublicKey) jwk.getPublicKey();
        } catch (JwkException e) {
            return null;
        }
    }

    @Override
    public RSAPrivateKey getPrivateKey() {
        // Only public keys can be obtained, private key acquisition is not supported.
        throw new UnsupportedOperationException("Get private key is not supported");
    }

    @Override
    public String getPrivateKeyId() {
        // Because it is undefined, null is returned according to the interface specification.
        return null;
    }

    @Override
    public void initialize() {
        // Create a provider to obtain public keys from JWKS endpoints published by Cognito.
        // This provider allows the following settings.
        // ・How long and how many results for each key ID (value of kid claim) should be cached.
        // ・How long and how many accesses to the JWKS endpoints are allowed.
        // ・Whether to go through a proxy server when accessing JWKS endpoints.
        // The following is set out here.
        // ・Cache up to 4 key IDs per hour (range cached for normal use even when key rotation is crossed)
        // ・Allow up to 10 accesses to JWKS endpoints per minute (range not reached in normal use considering cache)
        // ・Do not use a proxy server
        this.provider = new JwkProviderBuilder(createUserPoolUrl(region, userPoolId))
                .cached(true)
                .cached(4, 1, TimeUnit.HOURS)
                .rateLimited(true)
                .rateLimited(10, 1, TimeUnit.MINUTES)
                .proxied(Proxy.NO_PROXY)
                .build();
    }

@Path("/cognito/login")
public class LoginAction {

/**
 * Authentication is performed with the ID token, and if successful, a login session is established.
 *
 * @param context Execution Context
 * @param form Request body
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Valid
public void login(ExecutionContext context, LoginRequestForm form) {
    // Verify that the ID token is valid.
    DecodedJWT decodedJWT = verifyIdToken(form.getIdToken());

    // Change session ID and CSRF token after successful authentication to improve security.
    SessionUtil.changeId(context);
    CsrfTokenUtil.regenerateCsrfToken(context);

    // Identifies user information from information linked with ID token and maintains authentication status in the session.
    String userId = decodedJWT.getSubject();
    SessionUtil.put(context, "user.id", userId);
}

/**
 * Verify that the ID token is valid.
 *
 * @param idToken ID Token
 * @return Decoded ID token
 * @throws HttpErrorResponse If it is an invalid ID token (HTTP status code is 401)
 */
private DecodedJWT verifyIdToken(String idToken) {
    // Define components for validation using environment dependent values, which are retrieved from the system repository.
    IdTokenVerifier idTokenVerifier = SystemRepository.get("idTokenVerifier");
    try {
        // Verify ID token.
        return idTokenVerifier.verify(idToken);
    } catch (JWTVerificationException e) {
        if (LOGGER.isDebugEnabled()) {
            LOGGER.logDebug("ID token verification failed...", e);
        }
        // If the verification detects an abnormality, an error response with status code 401 (Unauthorized) is returned.
        throw new HttpErrorResponse(HttpResponse.Status.UNAUTHORIZED.getStatusCode());
    }
}