Package org.cibseven.bpm.client.interceptor.auth

Class JjwtClientAssertionProvider

java.lang.Object

org.cibseven.bpm.client.interceptor.auth.JjwtClientAssertionProvider

All Implemented Interfaces:

ClientAssertionProvider

public class JjwtClientAssertionProvider
extends Object
implements ClientAssertionProvider

Creates signed client assertion JWTs using the JJWT library.

The generated assertion conforms to RFC 7523 and can be used with OAuth2ClientCredentialsProvider for private_key_jwt client authentication.

Each call to getAssertion() produces a fresh JWT (new jti, iat, and exp). The actual access token is cached by OAuth2ClientCredentialsProvider; the assertion itself is intentionally short-lived (5 minutes) and regenerated only when a new token is needed.

Supported algorithms (auto-detected from key type):

• RS256 – RSA with SHA-256 (RSAPrivateKey, most widely supported)
• ES256 – ECDSA with P-256 and SHA-256 (ECPrivateKey on P-256 curve)

Requires io.jsonwebtoken:jjwt-api at compile time and io.jsonwebtoken:jjwt-impl at runtime.

Field Summary

Fields

Modifier and Type	Field	Description
protected static final long	ASSERTION_LIFETIME_MS	JWT lifetime in milliseconds (5 minutes).
protected final String	audience
protected final String	clientId
protected final PrivateKey	privateKey

Constructor Summary

Constructors

Constructor	Description
JjwtClientAssertionProvider(String clientId, String audience, PrivateKey privateKey)	Creates a provider that signs assertions with any supported private key.

Method Summary

Modifier and Type	Method	Description
String	getAssertion()	Generates and returns a freshly signed client assertion JWT.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ASSERTION_LIFETIME_MS

protected static final long ASSERTION_LIFETIME_MS

JWT lifetime in milliseconds (5 minutes).

See Also:

• Constant Field Values

clientId

protected final String clientId

audience

protected final String audience

privateKey

protected final PrivateKey privateKey

Constructor Details

JjwtClientAssertionProvider

public JjwtClientAssertionProvider(String clientId,
 String audience,
 PrivateKey privateKey)

Creates a provider that signs assertions with any supported private key. JJWT auto-detects the algorithm based on key type (RS256 for RSA, ES256 for EC P-256).

Parameters:

clientId - the OAuth2 client_id — used as both iss and sub claims

audience - the token endpoint URI — used as the aud claim

privateKey - the private key used for signing

Method Details

getAssertion

public String getAssertion()

Generates and returns a freshly signed client assertion JWT. JJWT automatically selects RS256 for RSAPrivateKey and ES256 for ECPrivateKey (P-256).

Specified by:

getAssertion in interface ClientAssertionProvider

Returns:

serialized signed JWT string

Throws:

ExternalTaskClientException - if signing fails