|
enum | apr_jose_type_e {
APR_JOSE_TYPE_NONE = 0
, APR_JOSE_TYPE_JWK = 1
, APR_JOSE_TYPE_JWKS
, APR_JOSE_TYPE_JWS
,
APR_JOSE_TYPE_JWS_JSON
, APR_JOSE_TYPE_JWE
, APR_JOSE_TYPE_JWE_JSON
, APR_JOSE_TYPE_JWT
,
APR_JOSE_TYPE_DATA
, APR_JOSE_TYPE_TEXT
, APR_JOSE_TYPE_JSON
} |
|
|
apu_err_t * | apr_jose_error (apr_jose_t *jose) |
| Get the result of the last operation on the jose. If the result is NULL, the operation was successful.
|
|
apr_jose_t * | apr_jose_make (apr_jose_t *jose, apr_jose_type_e type, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_jwk_make (apr_jose_t *jose, apr_json_value_t *key, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_jwks_make (apr_jose_t *jose, apr_json_value_t *keys, apr_pool_t *pool) |
|
apr_jose_signature_t * | apr_jose_signature_make (apr_jose_signature_t *signature, apr_json_value_t *header, apr_json_value_t *protected, void *ctx, apr_pool_t *pool) |
|
apr_jose_recipient_t * | apr_jose_recipient_make (apr_jose_recipient_t *recipient, apr_json_value_t *unprotected, void *ctx, apr_pool_t *pool) |
|
apr_jose_encryption_t * | apr_jose_encryption_make (apr_jose_encryption_t *encryption, apr_json_value_t *unprotected, apr_json_value_t *protected, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_jwe_make (apr_jose_t *jose, apr_jose_recipient_t *recipient, apr_array_header_t *recipients, apr_jose_encryption_t *encryption, apr_jose_t *payload, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_jwe_json_make (apr_jose_t *jose, apr_jose_recipient_t *recipient, apr_array_header_t *recipients, apr_jose_encryption_t *encryption, apr_jose_t *payload, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_jws_make (apr_jose_t *jose, apr_jose_signature_t *signature, apr_array_header_t *signatures, apr_jose_t *payload, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_jws_json_make (apr_jose_t *jose, apr_jose_signature_t *signature, apr_array_header_t *signatures, apr_jose_t *payload, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_jwt_make (apr_jose_t *jose, apr_json_value_t *claims, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_data_make (apr_jose_t *jose, const char *typ, const unsigned char *in, apr_size_t inlen, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_text_make (apr_jose_t *jose, const char *cty, const char *in, apr_size_t inlen, apr_pool_t *pool) |
|
apr_jose_t * | apr_jose_json_make (apr_jose_t *jose, const char *cty, apr_json_value_t *json, apr_pool_t *pool) |
|
apr_status_t | apr_jose_encode (apr_bucket_brigade *brigade, apr_brigade_flush flush, void *ctx, apr_jose_t *jose, apr_jose_cb_t *cb, apr_pool_t *pool) |
|
apr_status_t | apr_jose_decode (apr_jose_t **jose, const char *typ, apr_bucket_brigade *brigade, apr_jose_cb_t *cb, int level, int flags, apr_pool_t *pool) |
|
The JOSE (JSON Object Signing and Encryption) library allows the encoding and decoding of JWS (JSON Web Signature), JWE (JSON Web Encryption), JWK (JSON Web Key) and JWT (JSON Web Token) objects, encoded using compact encoding, JSON encoding, or flattened JSON encoding.
The following RFCs are supported:
Encryption, decryption, signing and verification are implemented as callbacks to the caller's specification, and are not included.
When decrypting or verifying, the caller MUST verify that the 'alg' algorithm parameter in the JOSE message matches the algorithm expected by the implementation.
It is recommended that the apr_crypto library be used to implement the callbacks, however an alternatively crypto library of the caller's choice may be used instead.
◆ APR_JOSE_FLAG_BREAK
#define APR_JOSE_FLAG_BREAK 2 |
When verifying or decrypting, break out of processing.
If the verification or decryption failed, processing will be aborted with the given error.
If the verification or decryption succeeded, processing will be considered successful and will move on to the nested structure.
◆ APR_JOSE_FLAG_DECODE_ALL
#define APR_JOSE_FLAG_DECODE_ALL 1 |
Return the full JOSE structure, instead of innermost nested structure.
◆ APR_JOSE_FLAG_NONE
#define APR_JOSE_FLAG_NONE 0 |
◆ APR_JOSE_JWA_ES256
#define APR_JOSE_JWA_ES256 "ES256" |
◆ APR_JOSE_JWA_ES384
#define APR_JOSE_JWA_ES384 "ES384" |
◆ APR_JOSE_JWA_ES512
#define APR_JOSE_JWA_ES512 "ES512" |
◆ APR_JOSE_JWA_HS256
#define APR_JOSE_JWA_HS256 "HS256" |
◆ APR_JOSE_JWA_HS384
#define APR_JOSE_JWA_HS384 "HS384" |
◆ APR_JOSE_JWA_HS512
#define APR_JOSE_JWA_HS512 "HS512" |
◆ APR_JOSE_JWA_NONE
#define APR_JOSE_JWA_NONE "none" |
◆ APR_JOSE_JWA_PS256
#define APR_JOSE_JWA_PS256 "PS256" |
◆ APR_JOSE_JWA_PS384
#define APR_JOSE_JWA_PS384 "PS384" |
◆ APR_JOSE_JWA_PS512
#define APR_JOSE_JWA_PS512 "PS512" |
◆ APR_JOSE_JWA_RS256
#define APR_JOSE_JWA_RS256 "RS256" |
◆ APR_JOSE_JWA_RS384
#define APR_JOSE_JWA_RS384 "RS384" |
◆ APR_JOSE_JWA_RS512
#define APR_JOSE_JWA_RS512 "RS512" |
◆ APR_JOSE_JWE_AAD
#define APR_JOSE_JWE_AAD "aad" |
◆ APR_JOSE_JWE_CIPHERTEXT
#define APR_JOSE_JWE_CIPHERTEXT "ciphertext" |
◆ APR_JOSE_JWE_COMPRESSION
#define APR_JOSE_JWE_COMPRESSION "zip" |
◆ APR_JOSE_JWE_EKEY
#define APR_JOSE_JWE_EKEY "encrypted_key" |
◆ APR_JOSE_JWE_ENCRYPTION
#define APR_JOSE_JWE_ENCRYPTION "enc" |
◆ APR_JOSE_JWE_IV
#define APR_JOSE_JWE_IV "iv" |
◆ APR_JOSE_JWE_RECIPIENTS
#define APR_JOSE_JWE_RECIPIENTS "recipients" |
◆ APR_JOSE_JWE_TAG
#define APR_JOSE_JWE_TAG "tag" |
◆ APR_JOSE_JWE_UNPROTECTED
#define APR_JOSE_JWE_UNPROTECTED "unprotected" |
◆ APR_JOSE_JWK_KEY_OPERATIONS
#define APR_JOSE_JWK_KEY_OPERATIONS "key_ops" |
◆ APR_JOSE_JWK_KEY_TYPE
#define APR_JOSE_JWK_KEY_TYPE "kty" |
◆ APR_JOSE_JWK_KEYS
#define APR_JOSE_JWK_KEYS "keys" |
◆ APR_JOSE_JWK_PUBLIC_KEY_USE
#define APR_JOSE_JWK_PUBLIC_KEY_USE "use" |
◆ APR_JOSE_JWKSE_ALGORITHM
#define APR_JOSE_JWKSE_ALGORITHM "alg" |
◆ APR_JOSE_JWKSE_KEYID
#define APR_JOSE_JWKSE_KEYID "kid" |
◆ APR_JOSE_JWKSE_X509_CHAIN
#define APR_JOSE_JWKSE_X509_CHAIN "x5c" |
◆ APR_JOSE_JWKSE_X509_SHA1_THUMBPRINT
#define APR_JOSE_JWKSE_X509_SHA1_THUMBPRINT "x5t" |
◆ APR_JOSE_JWKSE_X509_SHA256_THUMBPRINT
#define APR_JOSE_JWKSE_X509_SHA256_THUMBPRINT "x5t#S256" |
◆ APR_JOSE_JWKSE_X509_URL
#define APR_JOSE_JWKSE_X509_URL "x5u" |
◆ APR_JOSE_JWS_PAYLOAD
#define APR_JOSE_JWS_PAYLOAD "payload" |
◆ APR_JOSE_JWS_SIGNATURE
#define APR_JOSE_JWS_SIGNATURE "signature" |
◆ APR_JOSE_JWS_SIGNATURES
#define APR_JOSE_JWS_SIGNATURES "signatures" |
◆ APR_JOSE_JWSE_CONTENT_TYPE
#define APR_JOSE_JWSE_CONTENT_TYPE "cty" |
◆ APR_JOSE_JWSE_CRITICAL
#define APR_JOSE_JWSE_CRITICAL "crit" |
◆ APR_JOSE_JWSE_HEADER
#define APR_JOSE_JWSE_HEADER "header" |
◆ APR_JOSE_JWSE_JWK
#define APR_JOSE_JWSE_JWK "jwk" |
◆ APR_JOSE_JWSE_JWK_SET_URL
#define APR_JOSE_JWSE_JWK_SET_URL "jku" |
◆ APR_JOSE_JWSE_PROTECTED
#define APR_JOSE_JWSE_PROTECTED "protected" |
◆ APR_JOSE_JWSE_TYPE
#define APR_JOSE_JWSE_TYPE "typ" |
◆ APR_JOSE_JWSE_TYPE_JWT
#define APR_JOSE_JWSE_TYPE_JWT "JWT" |
◆ APR_JOSE_JWT_AUDIENCE
#define APR_JOSE_JWT_AUDIENCE "aud" |
◆ APR_JOSE_JWT_EXPIRATION_TIME
#define APR_JOSE_JWT_EXPIRATION_TIME "exp" |
◆ APR_JOSE_JWT_ID
#define APR_JOSE_JWT_ID "jti" |
◆ APR_JOSE_JWT_ISSUED_AT
#define APR_JOSE_JWT_ISSUED_AT "iat" |
◆ APR_JOSE_JWT_ISSUER
#define APR_JOSE_JWT_ISSUER "iss" |
◆ APR_JOSE_JWT_NOT_BEFORE
#define APR_JOSE_JWT_NOT_BEFORE "nbf" |
◆ APR_JOSE_JWT_SUBJECT
#define APR_JOSE_JWT_SUBJECT "sub" |
◆ apr_jose_cb_t
Callbacks for encryption, decryption, signing and verifying.
◆ apr_jose_data_t
Unsigned char data of a given length
◆ apr_jose_encryption_t
An encrypted payload within a a JSON web encryption.
◆ apr_jose_json_t
◆ apr_jose_jwe_t
◆ apr_jose_jwk_t
◆ apr_jose_jwks_t
◆ apr_jose_jws_t
◆ apr_jose_jwt_t
◆ apr_jose_recipient_t
A single recipient within a a JSON web encryption.
◆ apr_jose_signature_t
A single signature within a a JSON web signature.
◆ apr_jose_t
◆ apr_jose_text_t
Signed char data of a given length
◆ apr_jose_type_e
Enum that represents the type of JOSE object.
◆ apr_jose_type_e
Enum that represents the type of JOSE object.
Enumerator |
---|
APR_JOSE_TYPE_NONE | No specific type.
|
APR_JOSE_TYPE_JWK | JSON Web Key (JWK)
|
APR_JOSE_TYPE_JWKS | JSON Web Key Set (JWKS)
|
APR_JOSE_TYPE_JWS | JSON Web Signature (JWS) - compact encoding
|
APR_JOSE_TYPE_JWS_JSON | JSON Web Signature (JWS) - JSON encoding
|
APR_JOSE_TYPE_JWE | JSON Web Encryption (JWE) - compact encoding
|
APR_JOSE_TYPE_JWE_JSON | JSON Web Encryption (JWE) - JSON encoding
|
APR_JOSE_TYPE_JWT | JSON Web Token (JWT)
|
APR_JOSE_TYPE_DATA | Generic binary data
|
APR_JOSE_TYPE_TEXT | Generic text data
|
APR_JOSE_TYPE_JSON | Generic JSON structure
|
◆ apr_jose_data_make()
Make a data buffer for encoding from the given data and length.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
typ | the content type of this data. |
in | the plaintext to sign. |
inlen | length of the plaintext. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_decode()
Decode, decrypt and verify the utf8-encoded JOSE string into apr_jose_t.
The JOSE structure may be nested to the given limit.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
typ | content type of this object. |
brigade | the JOSE structure to decode. |
cb | callbacks for verify and decrypt. |
level | depth limit of JOSE and JSON nesting. |
flags | APR_JOSE_FLAG_NONE to return payload only. APR_JOSE_FLAG_DECODE_ALL to return the full JWS/JWE structure. |
pool | pool used to allocate the result from. |
◆ apr_jose_encode()
Sign or encrypt the apr_jose_t, and write it to the brigade.
- Parameters
-
brigade | brigade the result will be appended to. |
flush | The flush function to use if the brigade is full |
ctx | The structure to pass to the flush function |
jose | the JOSE to encode. |
cb | callbacks for sign and encrypt. |
pool | pool to be used. |
- Returns
- APR_SUCCESS is returned if encoding was successful, otherwise an APR status code, along with an apu_err_t with an explanation allocated from jose->pool.
◆ apr_jose_encryption_make()
Make an encryption structure for JWE.
- Parameters
-
encryption | the result. |
unprotected | the unprotected shared header. |
protected | the protected header. |
pool | the pool to use. |
- Returns
- The apr_jose_encryption_t is returned.
◆ apr_jose_error()
Get the result of the last operation on the jose. If the result is NULL, the operation was successful.
- Parameters
-
- Returns
- The apu_err_t is returned.
◆ apr_jose_json_make()
Make a json structure for encoding.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
cty | the content type. |
json | the json object to add. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_jwe_json_make()
Make a JSON encoded JWE.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
recipient | the recipient for compact / flattened JWE. |
recipients | the recipients array for general JWE. |
encryption | the encryption structure. |
payload | the JOSE payload to encrypt. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_jwe_make()
Make a compact encoded JWE.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
recipient | the recipient for compact / flattened JWE. |
recipients | the recipients array for general JWE. |
encryption | the encryption structure. |
payload | the JOSE payload to encrypt. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_jwk_make()
Make a JSON Web Key for encoding or decoding.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
key | the json representing the key. May be NULL. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_jwks_make()
Make a JSON Web Key Set.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
keys | the array of keys in JSON format. May be NULL. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_jws_json_make()
Make a JSON encoded JWS.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
signature | the header / protected header / signature used with compact or flattened syntax. May be NULL. |
signatures | array of header / protected header / signature used with general JSON syntax. |
payload | the payload to be wrapped by this JWS. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_jws_make()
Make a compact encoded JWS.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
signature | the header / protected header / signature used with compact or flattened syntax. May be NULL. |
signatures | array of header / protected header / signature used with general JSON syntax. |
payload | the payload to be wrapped by this JWS. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_jwt_make()
Make a JWT claims payload.
To create a useful JWT, this payload needs to be wrapped in a JWS or JWE (or both), as required by the caller.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
claims | the claims to sign. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_make()
Make a generic JOSE structure.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
type | the type of structure to create. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.
◆ apr_jose_recipient_make()
Make a recipient structure for JWE.
- Parameters
-
recipient | the result. |
unprotected | the unprotected header. |
ctx | user supplied context |
pool | the pool to use. |
- Returns
- The apr_jose_recipient_t is returned.
◆ apr_jose_signature_make()
Make a signature structure for JWS.
- Parameters
-
signature | the result. |
header | the unprotected header. |
protected | the protected header. |
ctx | user supplied context |
pool | the pool to use. |
- Returns
- The apr_jose_signature_t is returned.
◆ apr_jose_text_make()
Make a UTF-8 text buffer for encoding from the given string and length.
- Parameters
-
jose | If jose points at NULL, a JOSE structure will be created. If the jose pointer is not NULL, the structure will be reused. |
cty | the content type. |
in | the UTF-8 encoded text string. |
inlen | length of the UTF-8 encoded text string. |
pool | pool used to allocate the result from. |
- Returns
- The apr_jose_t is returned.