-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathLambdaFunction.java
More file actions
138 lines (121 loc) · 5.72 KB
/
Copy pathLambdaFunction.java
File metadata and controls
138 lines (121 loc) · 5.72 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
import com.amazonaws.services.lambda.runtime.Context;
import com.amazonaws.services.lambda.runtime.RequestHandler;
import com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent;
import com.amazonaws.services.lambda.runtime.events.APIGatewayProxyResponseEvent;
import com.auth0.jwk.*;
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTVerificationException;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.auth0.jwt.interfaces.JWTVerifier;
import java.util.Map;
/**
* Lambda function for validating JWT tokens issued by Keycloak.
*
* This function dynamically fetches public keys (JWKS) from Keycloak's JWKS URI to
* verify the signature of RS256-signed tokens. The function also validates key claims
* such as `issuer` and `audience` to ensure token validity.
*
* Build and Deployment Instructions:
* -----------------------------------
* 1. Add the required dependencies in your `pom.xml` (if using Maven) or `build.gradle` (Gradle):
* - auth0: JSON Web Token (JWT) library for token decoding and verification.
*
* Maven Dependency:
* <dependency>
* <groupId>com.auth0</groupId>
* <artifactId>java-jwt</artifactId>
* <version>4.3.0</version>
* </dependency>
* <dependency>
* <groupId>com.auth0</groupId>
* <artifactId>jwks-rsa</artifactId>
* <version>0.20.0</version>
* </dependency>
*
* 2. Package the Java file into a JAR using Maven or Gradle.
*
* Maven Command:
* mvn clean install
*
* Gradle Command:
* gradle build
*
* 3. Deploy the JAR to AWS Lambda.
* During deployment, select this class's handler: `LambdaFunction::handleRequest`.
*/
public class LambdaFunction implements RequestHandler<APIGatewayProxyRequestEvent, APIGatewayProxyResponseEvent> {
private static final String KEYCLOAK_ISSUER = "https://<keycloak-domain>/realms/<realm-name>";
private static final String KEYCLOAK_CLIENT_ID = "<client-id>";
private static final String KEYCLOAK_JWKS_URI = "https://<keycloak-domain>/realms/<realm-name>/protocol/openid-connect/certs";
/**
* AWS Lambda Handler function to validate a JWT token issued by Keycloak.
*
* @param request The incoming API Gateway Proxy Request containing headers, body, etc.
* @param context The AWS Lambda context object containing runtime information.
* @return APIGatewayProxyResponseEvent Response containing token validation result.
*/
@Override
public APIGatewayProxyResponseEvent handleRequest(APIGatewayProxyRequestEvent request, Context context) {
try {
// Extract Authorization header
Map<String, String> headers = request.getHeaders();
if (headers == null || !headers.containsKey("Authorization")) {
return createResponse(401, "Unauthorized: Missing Authorization header");
}
String authHeader = headers.get("Authorization");
if (!authHeader.startsWith("Bearer ")) {
return createResponse(401, "Malformed Authorization header");
}
String token = authHeader.substring(7); // Remove "Bearer " from the Header
// Validate the JWT and decode its payload
DecodedJWT decodedJWT = validateJwt(token);
// If successful, respond with decoded token claims
return createResponse(200, String.format("Token is valid. Claims: %s", decodedJWT.getClaims()));
} catch (Exception e) {
// Handle any validation or runtime error
return createResponse(401, String.format("Invalid or expired token: %s", e.getMessage()));
}
}
/**
* Validates the given JWT token using Keycloak's JWKS URI and Keycloak configuration.
*
* @param token The JWT token string to validate.
* @return DecodedJWT The decoded JWT object, containing payload claims.
* @throws Exception If the token is invalid, expired, or cannot be verified.
*/
private DecodedJWT validateJwt(String token) throws Exception {
try {
// Create JWKS client loading keys from the Keycloak JWKS URI
JwkProvider jwkProvider = new UrlJwkProvider(KEYCLOAK_JWKS_URI);
// Decode the token's header to extract `kid` (Key ID)
DecodedJWT jwt = JWT.decode(token);
String kid = jwt.getKeyId();
// Fetch the public key matching the `kid`
Jwk jwk = jwkProvider.get(kid);
Algorithm algorithm = Algorithm.RSA256((java.security.interfaces.RSAPublicKey) jwk.getPublicKey(), null);
// Validate the token's signature and claims
JWTVerifier verifier = JWT.require(algorithm)
.withIssuer(KEYCLOAK_ISSUER) // Validate the Keycloak realm's issuer
.withAudience(KEYCLOAK_CLIENT_ID) // Validate the audience for your client ID
.build();
// Return the decoded JWT if valid
return verifier.verify(token);
} catch (JwkException | JWTVerificationException e) {
throw new Exception("JWT validation failed: " + e.getMessage());
}
}
/**
* Utility method to create a response for API Gateway.
*
* @param statusCode The HTTP status code of the response.
* @param message The body message of the response.
* @return APIGatewayProxyResponseEvent The response object for API Gateway.
*/
private APIGatewayProxyResponseEvent createResponse(int statusCode, String message) {
APIGatewayProxyResponseEvent response = new APIGatewayProxyResponseEvent();
response.setStatusCode(statusCode);
response.setBody(String.format("{\"message\": \"%s\"}", message));
return response;
}
}