import com.nimbusds.jose.proc.BadJOSEException; //导入依赖的package包/类
@Override
public IDTokenClaimsSet validate(final JWT idToken, final Nonce expectedNonce) throws BadJOSEException, JOSEException {
    try {
        if (originalIssuer.contains("%7Btenantid%7D")) {
            Object tid = idToken.getJWTClaimsSet().getClaim("tid");
            if (tid == null) {
                throw new BadJWTException("ID token does not contain the 'tid' claim");
            }
            base = new IDTokenValidator(new Issuer(originalIssuer.replace("%7Btenantid%7D", tid.toString())),
                    base.getClientID(), base.getJWSKeySelector(), base.getJWEKeySelector());
            base.setMaxClockSkew(getMaxClockSkew());
        }
    } catch (ParseException e) {
        throw new BadJWTException(e.getMessage(), e);
    }
    return base.validate(idToken, expectedNonce);
}
 

import com.nimbusds.jose.proc.BadJOSEException; //导入依赖的package包/类
public UserPrincipal(String idToken) throws MalformedURLException, ParseException,
        BadJOSEException, JOSEException {
    final ConfigurableJWTProcessor<SecurityContext> validator = getAadJwtTokenValidator();
    jwtClaimsSet = validator.process(idToken, null);
    final JWTClaimsSetVerifier<SecurityContext> verifier = validator
            .getJWTClaimsSetVerifier();
    verifier.verify(jwtClaimsSet, null);
    jwsObject = JWSObject.parse(idToken);
    userGroups = null;
}
 

import com.nimbusds.jose.proc.BadJOSEException; //导入依赖的package包/类
private IDTokenClaimsSet validateToken(OAuthProvider provider, OAuthLoginRequestDTO oAuthLoginRequestDTO) throws MalformedURLException, ParseException, BadJOSEException, JOSEException {
    Issuer iss = new Issuer(provider.getIssuer());
    ClientID clientID = new ClientID(provider.getClientID());
    Nonce nonce = new Nonce(oAuthLoginRequestDTO.getNonce());
    URL jwkSetURL = new URL(provider.getJwkSetURL());
    JWSAlgorithm jwsAlg = JWSAlgorithm.parse(provider.getJwsAlgorithm());
    IDTokenValidator validator = new IDTokenValidator(iss, clientID, jwsAlg, jwkSetURL);
    JWT idToken = JWTParser.parse(oAuthLoginRequestDTO.getIdToken());
    return validator.validate(idToken, nonce);
}
 

import com.nimbusds.jose.proc.BadJOSEException; //导入依赖的package包/类
@Override
public JsonObject process(String jwt) throws JWTException {
    try {
        String rawJwt = delegate.process(jwt, null).toString();
        return Json.createReader(new StringReader(rawJwt)).readObject();
    } catch (ParseException | BadJOSEException | JOSEException e) {
        throw new JWTException("Unable to parse jwt", e);
    }
}
 

import com.nimbusds.jose.proc.BadJOSEException; //导入依赖的package包/类
@Test(expected = BadJOSEException.class)
public void whenSignedJWTWithoutMatchingKeyInAuthorizationHeaderProvidedParseExceptionOccurs() throws Exception {
    request.addHeader("Authorization", newJwtToken(UNKNOWN_KID,"role1").serialize());
    assertThat(awsCognitoIdTokenProcessor.getAuthentication(request)).isNull();
}
 

import com.nimbusds.jose.proc.BadJOSEException; //导入依赖的package包/类
@Override
@SuppressWarnings("unchecked")
public U create(final OidcCredentials credentials, final WebContext context) throws HttpAction {
    init(context);

    final AccessToken accessToken = credentials.getAccessToken();

    // Create profile
    final U profile = getProfileFactory().get();
    profile.setAccessToken(accessToken);
    final JWT idToken = credentials.getIdToken();
    profile.setIdTokenString(idToken.getParsedString());
    // Check if there is a refresh token
    final RefreshToken refreshToken = credentials.getRefreshToken();
    if (refreshToken != null && !refreshToken.getValue().isEmpty()) {
        profile.setRefreshToken(refreshToken);
        logger.debug("Refresh Token successful retrieved");
    }

    try {

        // check idToken
        final Nonce nonce;
        if (configuration.isUseNonce()) {
            nonce = new Nonce((String) context.getSessionAttribute(OidcConfiguration.NONCE_SESSION_ATTRIBUTE));
        } else {
            nonce = null;
        }
        // Check ID Token
        final IDTokenClaimsSet claimsSet = this.idTokenValidator.validate(idToken, nonce);
        assertNotNull("claimsSet", claimsSet);
        profile.setId(claimsSet.getSubject());

        // User Info request
        if (configuration.getProviderMetadata().getUserInfoEndpointURI() != null && accessToken != null) {
            final UserInfoRequest userInfoRequest = new UserInfoRequest(configuration.getProviderMetadata().getUserInfoEndpointURI(), (BearerAccessToken) accessToken);
            final HTTPRequest userInfoHttpRequest = userInfoRequest.toHTTPRequest();
            userInfoHttpRequest.setConnectTimeout(configuration.getConnectTimeout());
            userInfoHttpRequest.setReadTimeout(configuration.getReadTimeout());
            final HTTPResponse httpResponse = userInfoHttpRequest.send();
            logger.debug("Token response: status={}, content={}", httpResponse.getStatusCode(),
                    httpResponse.getContent());

            final UserInfoResponse userInfoResponse = UserInfoResponse.parse(httpResponse);
            if (userInfoResponse instanceof UserInfoErrorResponse) {
                logger.error("Bad User Info response, error={}",
                        ((UserInfoErrorResponse) userInfoResponse).getErrorObject());
            } else {
                final UserInfoSuccessResponse userInfoSuccessResponse = (UserInfoSuccessResponse) userInfoResponse;
                final UserInfo userInfo = userInfoSuccessResponse.getUserInfo();
                if (userInfo != null) {
                    profile.addAttributes(userInfo.toJWTClaimsSet().getClaims());
                }
            }
        }

        // add attributes of the ID token if they don't already exist
        for (final Map.Entry<String, Object> entry : idToken.getJWTClaimsSet().getClaims().entrySet()) {
            final String key = entry.getKey();
            final Object value = entry.getValue();
            if (profile.getAttribute(key) == null) {
                profile.addAttribute(key, value);
            }
        }

        return profile;

    } catch (final IOException | ParseException | JOSEException | BadJOSEException | java.text.ParseException e) {
        throw new TechnicalException(e);
    }
}