Rhonabwy: JWT functions

Rhonabwy Create, modify, parse or export Json Web Keys as defined in the RFC 7517

Functions
JWT functions

## Functions
jwt_t * | r_jwt_copy (jwt_t *jwt)
int | r_jwt_set_header_str_value (jwt_t *jwt, const char *key, const char *str_value)
int | r_jwt_set_header_int_value (jwt_t *jwt, const char *key, int i_value)
int | r_jwt_set_header_json_t_value (jwt_t *jwt, const char *key, json_t *j_value)
const char * | r_jwt_get_header_str_value (jwt_t *jwt, const char *key)
int | r_jwt_get_header_int_value (jwt_t *jwt, const char *key)
json_t * | r_jwt_get_header_json_t_value (jwt_t *jwt, const char *key)
json_t * | r_jwt_get_full_header_json_t (jwt_t *jwt)
char * | r_jwt_get_full_header_str (jwt_t *jwt)
int | r_jwt_set_claim_str_value (jwt_t *jwt, const char *key, const char *str_value)
int | r_jwt_set_claim_int_value (jwt_t *jwt, const char *key, int i_value)
int | r_jwt_set_claim_json_t_value (jwt_t *jwt, const char *key, json_t *j_value)
const char * | r_jwt_get_claim_str_value (jwt_t *jwt, const char *key)
int | r_jwt_get_claim_int_value (jwt_t *jwt, const char *key)
json_t * | r_jwt_get_claim_json_t_value (jwt_t *jwt, const char *key)
json_t * | r_jwt_get_full_claims_json_t (jwt_t *jwt)
char * | r_jwt_get_full_claims_str (jwt_t *jwt)
int | r_jwt_set_full_claims_json_t (jwt_t *jwt, json_t *j_claim)
int | r_jwt_set_full_claims_json_str (jwt_t *jwt, const char *str_claims)
int | r_jwt_append_claims_json_t (jwt_t *jwt, json_t *j_claim)
int | r_jwt_add_sign_keys (jwt_t *jwt, jwk_t *privkey, jwk_t *pubkey)
int | r_jwt_add_sign_jwks (jwt_t *jwt, jwks_t *jwks_privkey, jwks_t *jwks_pubkey)
int | r_jwt_add_sign_keys_json_str (jwt_t *jwt, const char *privkey, const char *pubkey)
int | r_jwt_add_sign_keys_json_t (jwt_t *jwt, json_t *privkey, json_t *pubkey)
int | r_jwt_add_sign_keys_pem_der (jwt_t *jwt, int format, const unsigned char *privkey, size_t privkey_len, const unsigned char *pubkey, size_t pubkey_len)
int | r_jwt_add_sign_keys_gnutls (jwt_t *jwt, gnutls_privkey_t privkey, gnutls_pubkey_t pubkey)
int | r_jwt_add_sign_key_symmetric (jwt_t *jwt, const unsigned char *key, size_t key_len)
jwks_t * | r_jwt_get_sign_jwks_privkey (jwt_t *jwt)
jwks_t * | r_jwt_get_sign_jwks_pubkey (jwt_t *jwt)
int | r_jwt_add_enc_keys (jwt_t *jwt, jwk_t *privkey, jwk_t *pubkey)
int | r_jwt_add_enc_jwks (jwt_t *jwt, jwks_t *jwks_privkey, jwks_t *jwks_pubkey)
int | r_jwt_add_enc_keys_json_str (jwt_t *jwt, const char *privkey, const char *pubkey)
int | r_jwt_add_enc_keys_json_t (jwt_t *jwt, json_t *privkey, json_t *pubkey)
int | r_jwt_add_enc_keys_pem_der (jwt_t *jwt, int format, const unsigned char *privkey, size_t privkey_len, const unsigned char *pubkey, size_t pubkey_len)
int | r_jwt_add_enc_keys_gnutls (jwt_t *jwt, gnutls_privkey_t privkey, gnutls_pubkey_t pubkey)
int | r_jwt_add_enc_key_symmetric (jwt_t *jwt, const unsigned char *key, size_t key_len)
jwks_t * | r_jwt_get_enc_jwks_privkey (jwt_t *jwt)
jwks_t * | r_jwt_get_enc_jwks_pubkey (jwt_t *jwt)
int | r_jwt_set_sign_alg (jwt_t *jwt, jwa_alg alg)
jwa_alg | r_jwt_get_sign_alg (jwt_t *jwt)
int | r_jwt_set_enc_alg (jwt_t *jwt, jwa_alg alg)
jwa_alg | r_jwt_get_enc_alg (jwt_t *jwt)
int | r_jwt_set_enc (jwt_t *jwt, jwa_enc enc)
jwa_enc | r_jwt_get_enc (jwt_t *jwt)
char * | r_jwt_serialize_signed (jwt_t *jwt, jwk_t *privkey, int x5u_flags)
char * | r_jwt_serialize_encrypted (jwt_t *jwt, jwk_t *pubkey, int x5u_flags)
char * | r_jwt_serialize_nested (jwt_t *jwt, unsigned int type, jwk_t *sign_key, int sign_key_x5u_flags, jwk_t *encrypt_key, int encrypt_key_x5u_flags)
int | r_jwt_parse (jwt_t *jwt, const char *token, int x5u_flags)
int | r_jwt_parsen (jwt_t *jwt, const char *token, size_t token_len, int x5u_flags)
int | r_jwt_get_type (jwt_t *jwt)
int | r_jwt_verify_signature (jwt_t *jwt, jwk_t *pubkey, int x5u_flags)
int | r_jwt_decrypt (jwt_t *jwt, jwk_t *privkey, int x5u_flags)
int | r_jwt_decrypt_verify_signature_nested (jwt_t *jwt, jwk_t *verify_key, int verify_key_x5u_flags, jwk_t *decrypt_key, int decrypt_key_x5u_flags)
int | r_jwt_decrypt_nested (jwt_t *jwt, jwk_t *decrypt_key, int decrypt_key_x5u_flags)
int | r_jwt_verify_signature_nested (jwt_t *jwt, jwk_t *verify_key, int verify_key_x5u_flags)
int | r_jwt_validate_claims (jwt_t *jwt,...)

## Detailed Description

Manage JSON Web Token

## Function Documentation

## ◆ r_jwt_copy()

jwt_t* r_jwt_copy | ( | jwt_t * | jwt | ) |

Return a copy of the JWT

Parameters

  jwt | the jwt_t to duplicate

Returns
  a copy of jwt

## ◆ r_jwt_set_header_str_value()

int r_jwt_set_header_str_value | ( | jwt_t * | jwt,
|  | const char * | key,
|  | const char * | str_value
| ) |  |

Adds a string value to the JWT header

Parameters

  jwt | the jwt_t to update
  key | the key to set to the JWT header
  str_value | the value to set

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_set_header_int_value()

int r_jwt_set_header_int_value | ( | jwt_t * | jwt,
|  | const char * | key,
|  | int | i_value
| ) |  |

Adds an integer value to the JWT header

Parameters

  jwt | the jwt_t to update
  key | the key to set to the JWT header
  i_value | the value to set

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_set_header_json_t_value()

int r_jwt_set_header_json_t_value | ( | jwt_t * | jwt,
|  | const char * | key,
|  | json_t * | j_value
| ) |  |

Adds a JSON value to the JWT header

Parameters

  jwt | the jwt_t to update
  key | the key to set to the JWT header
  j_value | the value to set

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_get_header_str_value()

const char* r_jwt_get_header_str_value | ( | jwt_t * | jwt,
|  | const char * | key
| ) |  |

Gets a string value from the JWT header

Parameters

  jwt | the jwt_t to get the value
  key | the key to retreive the value

Returns
  a string value, NULL if not present

## ◆ r_jwt_get_header_int_value()

int r_jwt_get_header_int_value | ( | jwt_t * | jwt,
|  | const char * | key
| ) |  |

Gets an integer value from the JWT header

Parameters

  jwt | the jwt_t to get the value
  key | the key to retreive the value

Returns
  an int value, 0 if not present

## ◆ r_jwt_get_header_json_t_value()

json_t* r_jwt_get_header_json_t_value | ( | jwt_t * | jwt,
|  | const char * | key
| ) |  |

Gets a JSON value from the JWT header

Parameters

  jwt | the jwt_t to get the value
  key | the key to retreive the value

Returns
  a json_t * value, NULL if not present

## ◆ r_jwt_get_full_header_json_t()

json_t* r_jwt_get_full_header_json_t | ( | jwt_t * | jwt | ) |

Return the full JWT header in JSON format

Parameters

  jwt | the jwt_t to get the value

Returns
  a json_t * value

## ◆ r_jwt_get_full_header_str()

char* r_jwt_get_full_header_str | ( | jwt_t * | jwt | ) |

Return the full JWT header in char *

Parameters

  jwt | the jwt_t to get the value

Returns
  a char * value, must be r_free'd after use

## ◆ r_jwt_set_claim_str_value()

int r_jwt_set_claim_str_value | ( | jwt_t * | jwt,
|  | const char * | key,
|  | const char * | str_value
| ) |  |

Adds a string value to the JWT claim

Parameters

  jwt | the jwt_t to update
  key | the key to set to the JWT claim
  str_value | the value to set

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_set_claim_int_value()

int r_jwt_set_claim_int_value | ( | jwt_t * | jwt,
|  | const char * | key,
|  | int | i_value
| ) |  |

Adds an integer value to the JWT claim

Parameters

  jwt | the jwt_t to update
  key | the key to set to the JWT claim
  i_value | the value to set

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_set_claim_json_t_value()

int r_jwt_set_claim_json_t_value | ( | jwt_t * | jwt,
|  | const char * | key,
|  | json_t * | j_value
| ) |  |

Adds a JSON value to the JWT claim

Parameters

  jwt | the jwt_t to update
  key | the key to set to the JWT claim
  j_value | the value to set

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_get_claim_str_value()

const char* r_jwt_get_claim_str_value | ( | jwt_t * | jwt,
|  | const char * | key
| ) |  |

Gets a string value from the JWT claim

Parameters

  jwt | the jwt_t to get the value
  key | the key to retreive the value

Returns
  a string value, NULL if not present

## ◆ r_jwt_get_claim_int_value()

int r_jwt_get_claim_int_value | ( | jwt_t * | jwt,
|  | const char * | key
| ) |  |

Gets an integer value from the JWT claim

Parameters

  jwt | the jwt_t to get the value
  key | the key to retreive the value

Returns
  an int value, 0 if not present

## ◆ r_jwt_get_claim_json_t_value()

json_t* r_jwt_get_claim_json_t_value | ( | jwt_t * | jwt,
|  | const char * | key
| ) |  |

Gets a JSON value from the JWT claim

Parameters

  jwt | the jwt_t to get the value
  key | the key to retreive the value

Returns
  a json_t * value, NULL if not present

## ◆ r_jwt_get_full_claims_json_t()

json_t* r_jwt_get_full_claims_json_t | ( | jwt_t * | jwt | ) |

Return the full JWT claim in JSON format

Parameters

  jwt | the jwt_t to get the value

Returns
  a json_t * value

## ◆ r_jwt_get_full_claims_str()

char* r_jwt_get_full_claims_str | ( | jwt_t * | jwt | ) |

Return the full JWT claims in char *

Parameters

  jwt | the jwt_t to get the value

Returns
  a char * value, must be r_free'd after use

## ◆ r_jwt_set_full_claims_json_t()

int r_jwt_set_full_claims_json_t | ( | jwt_t * | jwt,
|  | json_t * | j_claim
| ) |  |

Set the full JWT claim in JSON format delete all existing value

Parameters

  jwt | the jwt_t to get the value
  j_claim | the claim to set, must be JSON object

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_set_full_claims_json_str()

int r_jwt_set_full_claims_json_str | ( | jwt_t * | jwt,
|  | const char * | str_claims
| ) |  |

Set the full JWT claim in JSON format delete all existing value

Parameters

  jwt | the jwt_t to get the value
  str_claims | the claim to set, must be JSON object in string format

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_append_claims_json_t()

int r_jwt_append_claims_json_t | ( | jwt_t * | jwt,
|  | json_t * | j_claim
| ) |  |

Append the given JSON object in the JWT payload Replace existing claim if already set

Parameters

  jwt | the jwt_t to get the value
  j_claim | the payload to set, must be JSON object

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_sign_keys()

int r_jwt_add_sign_keys | ( | jwt_t * | jwt,
|  | jwk_t * | privkey,
|  | jwk_t * | pubkey
| ) |  |

Add keys to perform signature or signature verification to the JWT

Parameters

  jwt | the jwt_t to update
  privkey | the private key to sign the JWT
  pubkey | the public key to verify the JWT signature

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_sign_jwks()

int r_jwt_add_sign_jwks | ( | jwt_t * | jwt,
|  | jwks_t * | jwks_privkey,
|  | jwks_t * | jwks_pubkey
| ) |  |

Adds private and/or public keys sets for the signature and verification

Parameters

  jwt | the jwt_t to update
  jwks_privkey | the private key set in jwk_t * format, can be NULL
  jwks_pubkey | the public key set in jwk_t * format, can be NULL

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_sign_keys_json_str()

int r_jwt_add_sign_keys_json_str | ( | jwt_t * | jwt,
|  | const char * | privkey,
|  | const char * | pubkey
| ) |  |

Add keys to perform signature or signature verification to the JWT keys must be a JWK stringified

Parameters

  jwt | the jwt_t to update
  privkey | the private key to sign the JWT
  pubkey | the public key to verify the JWT signature

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_sign_keys_json_t()

int r_jwt_add_sign_keys_json_t | ( | jwt_t * | jwt,
|  | json_t * | privkey,
|  | json_t * | pubkey
| ) |  |

Add keys to perform signature or signature verification to the JWT keys must be a JWK in json_t * format

Parameters

  jwt | the jwt_t to update
  privkey | the private key to sign the JWT
  pubkey | the public key to verify the JWT signature

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_sign_keys_pem_der()

int r_jwt_add_sign_keys_pem_der | ( | jwt_t * | jwt,
|  | int | format,
|  | const unsigned char * | privkey,
|  | size_t | privkey_len,
|  | const unsigned char * | pubkey,
|  | size_t | pubkey_len
| ) |  |

Add keys to perform signature or signature verification to the JWT keys must be in PEM or DER format

Parameters

  jwt | the jwt_t to update
  format | the format of the input, values available are R_FORMAT_PEM or R_FORMAT_DER
  privkey | the private key to sign the
  privkey_len | length of privkey
  pubkey | the public key to verify the signature
  pubkey_len | length of pubkey

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_sign_keys_gnutls()

int r_jwt_add_sign_keys_gnutls | ( | jwt_t * | jwt,
|  | gnutls_privkey_t | privkey,
|  | gnutls_pubkey_t | pubkey
| ) |  |

Add keys to perform signature or signature verification to the JWT keys must be gnutls key structures

Parameters

  jwt | the jwt_t to update
  privkey | the private key to sign the JWT
  pubkey | the public key to verify the JWT signature

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_sign_key_symmetric()

int r_jwt_add_sign_key_symmetric | ( | jwt_t * | jwt,
|  | const unsigned char * | key,
|  | size_t | key_len
| ) |  |

Add symmetric key by value to perform signature or signature verification to the JWT

Parameters

  jwt | the jwt_t to update
  key | the raw key value
  key_len | the length of the key

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_get_sign_jwks_privkey()

jwks_t* r_jwt_get_sign_jwks_privkey | ( | jwt_t * | jwt | ) |

Get private keys set for the signature

Parameters

  jwt | the jwt_t to get the value

Returns
  the private key set in jwks_t * format

## ◆ r_jwt_get_sign_jwks_pubkey()

jwks_t* r_jwt_get_sign_jwks_pubkey | ( | jwt_t * | jwt | ) |

Get public keys set for the verification

Parameters

  jwt | the jwt_t to get the value

Returns
  the public key set in jwks_t * format

## ◆ r_jwt_add_enc_keys()

int r_jwt_add_enc_keys | ( | jwt_t * | jwt,
|  | jwk_t * | privkey,
|  | jwk_t * | pubkey
| ) |  |

Add keys to perform encryption ot decryption to the JWT

Parameters

  jwt | the jwt_t to update
  privkey | the private key to decrypt the JWT
  pubkey | the public key to encrypt the JWT

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_enc_jwks()

int r_jwt_add_enc_jwks | ( | jwt_t * | jwt,
|  | jwks_t * | jwks_privkey,
|  | jwks_t * | jwks_pubkey
| ) |  |

Adds private and/or public keys sets for the cypher key encryption and decryption

Parameters

  jwt | the jwt_t to update
  jwks_privkey | the private key set in jwks_t * format, can be NULL
  jwks_pubkey | the public key set in jwks_t * format, can be NULL

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_enc_keys_json_str()

int r_jwt_add_enc_keys_json_str | ( | jwt_t * | jwt,
|  | const char * | privkey,
|  | const char * | pubkey
| ) |  |

Add keys to perform encryption ot decryption to the JWT keys must be a JWK stringified

Parameters

  jwt | the jwt_t to update
  privkey | the private key to enc the JWT
  pubkey | the public key to verify the JWT encature

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_enc_keys_json_t()

int r_jwt_add_enc_keys_json_t | ( | jwt_t * | jwt,
|  | json_t * | privkey,
|  | json_t * | pubkey
| ) |  |

Add keys to perform encryption ot decryption to the JWT keys must be a JWK in json_t * format

Parameters

  jwt | the jwt_t to update
  privkey | the private key to enc the JWT
  pubkey | the public key to verify the JWT encature

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_enc_keys_pem_der()

int r_jwt_add_enc_keys_pem_der | ( | jwt_t * | jwt,
|  | int | format,
|  | const unsigned char * | privkey,
|  | size_t | privkey_len,
|  | const unsigned char * | pubkey,
|  | size_t | pubkey_len
| ) |  |

Add keys to perform encryption ot decryption to the JWT keys must be in PEM or DER format

Parameters

  jwt | the jwt_t to update
  format | the format of the input, values available are R_FORMAT_PEM or R_FORMAT_DER
  privkey | the private key to sign the
  privkey_len | length of privkey
  pubkey | the public key to verify the signature
  pubkey_len | length of pubkey

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_enc_keys_gnutls()

int r_jwt_add_enc_keys_gnutls | ( | jwt_t * | jwt,
|  | gnutls_privkey_t | privkey,
|  | gnutls_pubkey_t | pubkey
| ) |  |

Add keys to perform encryption ot decryption to the JWT keys must be gnutls key structures

Parameters

  jwt | the jwt_t to update
  privkey | the private key to enc the JWT
  pubkey | the public key to verify the JWT encature

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_add_enc_key_symmetric()

int r_jwt_add_enc_key_symmetric | ( | jwt_t * | jwt,
|  | const unsigned char * | key,
|  | size_t | key_len
| ) |  |

Add symmetric key by value to perform encryption ot decryption to the JWT

Parameters

  jwt | the jwt_t to update
  key | the raw key value
  key_len | the length of the key

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_get_enc_jwks_privkey()

jwks_t* r_jwt_get_enc_jwks_privkey | ( | jwt_t * | jwt | ) |

Get private keys set for the cypher key decryption

Parameters

  jwt | the jwt_t to get the value

Returns
  the private key set in jwks_t * format

## ◆ r_jwt_get_enc_jwks_pubkey()

jwks_t* r_jwt_get_enc_jwks_pubkey | ( | jwt_t * | jwt | ) |

Get public keys set for the cypher key encryption

Parameters

  jwt | the jwt_t to get the value

Returns
  the public key set in jwks_t * format

## ◆ r_jwt_set_sign_alg()

int r_jwt_set_sign_alg | ( | jwt_t * | jwt,
|  | jwa_alg | alg
| ) |  |

Set the JWT alg to use for signature

Parameters

  jwt | the jwt_t to update
  alg | the algorithm to use for signature

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_get_sign_alg()

jwa_alg r_jwt_get_sign_alg | ( | jwt_t * | jwt | ) |

Get the JWT alg used for signature

Parameters

  jwt | the jwt_t to update

Returns
  the algorithm used for signature

## ◆ r_jwt_set_enc_alg()

int r_jwt_set_enc_alg | ( | jwt_t * | jwt,
|  | jwa_alg | alg
| ) |  |

Set the JWT alg to use for key encryption

Parameters

  jwt | the jwt_t to update
  alg | the algorithm to use for key encryption

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_get_enc_alg()

jwa_alg r_jwt_get_enc_alg | ( | jwt_t * | jwt | ) |

Get the JWT alg used for key encryption

Parameters

  jwt | the jwt_t to update

Returns
  the algorithm used for key encryption

## ◆ r_jwt_set_enc()

int r_jwt_set_enc | ( | jwt_t * | jwt,
|  | jwa_enc | enc
| ) |  |

Set the JWT enc to use for payload encryption

Parameters

  jwt | the jwt_t to update
  enc | the encorithm to use for payload encryption

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_get_enc()

jwa_enc r_jwt_get_enc | ( | jwt_t * | jwt | ) |

Get the JWT enc used for payload encryption

Parameters

  jwt | the jwt_t to update

Returns
  the encorithm used for payload encryption

## ◆ r_jwt_serialize_signed()

char* r_jwt_serialize_signed | ( | jwt_t * | jwt,
|  | jwk_t * | privkey,
|  | int | x5u_flags
| ) |  |

Return a signed JWT in serialized format (xxx.yyy.zzz)

Parameters

  jwt | the jwt_t to sign
  privkey | the private key to sign the JWT, may be NULL
  x5u_flags | Flags to retrieve x5u certificates pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return NULL

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_serialize_encrypted()

char* r_jwt_serialize_encrypted | ( | jwt_t * | jwt,
|  | jwk_t * | pubkey,
|  | int | x5u_flags
| ) |  |

Return an encrypted JWT in serialized format (xxx.yyy.zzz.aaa.bbb)

Parameters

  jwt | the jwt_t to encrypt
  pubkey | the public key to encrypt the JWT, may be NULL
  x5u_flags | Flags to retrieve x5u certificates pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return NULL

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_serialize_nested()

char* r_jwt_serialize_nested | ( | jwt_t * | jwt,
|  | unsigned int | type,
|  | jwk_t * | sign_key,
|  | int | sign_key_x5u_flags,
|  | jwk_t * | encrypt_key,
|  | int | encrypt_key_x5u_flags
| ) |  |

Return a nested JWT in serialized format A nested JWT can be signed, then encrypted, or encrypted, then signed

Parameters

  jwt | the jwt_t to serialize
  type | the nesting type Values available are R_JWT_TYPE_NESTED_SIGN_THEN_ENCRYPT: the JWT will be signed, then the token will be encrypted in a JWE R_JWT_TYPE_NESTED_ENCRYPT_THEN_SIGN: The JWT will be encrypted, then the token will be signed in a JWS
  sign_key | the key to sign the JWT, may be NULL
  sign_key_x5u_flags | Flags to retrieve x5u certificates in sign_key pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return NULL
  encrypt_key | the key to encrypt the JWT, may be NULL
  encrypt_key_x5u_flags | Flags to retrieve x5u certificates in encrypt_key pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return NULL

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_parse()

int r_jwt_parse | ( | jwt_t * | jwt,
|  | const char * | token,
|  | int | x5u_flags
| ) |  |

Parse a serialized JWT If the JWT is signed only, the claims will be available If the JWT is encrypted, the claims will not be accessible until r_jwt_decrypt or r_jwt_decrypt_verify_signature_nested is succesfull

Parameters

  jwt | the jwt that will contain the parsed token
  token | the token to parse into a JWT, must end with a NULL string terminator
  x5u_flags | Flags to retrieve x5u certificates pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return an error

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_parsen()

int r_jwt_parsen | ( | jwt_t * | jwt,
|  | const char * | token,
|  | size_t | token_len,
|  | int | x5u_flags
| ) |  |

Parse a serialized JWT If the JWT is signed only, the claims will be available If the JWT is encrypted, the claims will not be accessible until r_jwt_decrypt or r_jwt_decrypt_verify_signature_nested is succesfull

Parameters

  jwt | the jwt that will contain the parsed token
  token | the token to parse into a JWT
  token_len | token length
  x5u_flags | Flags to retrieve x5u certificates pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return an error

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_get_type()

int r_jwt_get_type | ( | jwt_t * | jwt | ) |

Get the type of JWT after a succesfull r_jwt_parse

Parameters

  jwt | the jwt_t to check

Returns
  the type of JWT, values available are R_JWT_TYPE_NONE: not a JWT R_JWT_TYPE_SIGN: A signed JWT R_JWT_TYPE_ENCRYPT: An encrypted JWT R_JWT_TYPE_NESTED_SIGN_THEN_ENCRYPT: A nested JWT first signed, then encrypted R_JWT_TYPE_NESTED_ENCRYPT_THEN_SIGN: A nested JWT first encrypted, then signed

## ◆ r_jwt_verify_signature()

int r_jwt_verify_signature | ( | jwt_t * | jwt,
|  | jwk_t * | pubkey,
|  | int | x5u_flags
| ) |  |

Verifies the signature of the JWT The JWT must contain a signature or the JWT must have alg: none

Parameters

  jwt | the jwt_t to update
  pubkey | the public key to check the signature, can be NULL if jws already contains a public key
  x5u_flags | Flags to retrieve x5u certificates in pubkey pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return an error

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_decrypt()

int r_jwt_decrypt | ( | jwt_t * | jwt,
|  | jwk_t * | privkey,
|  | int | x5u_flags
| ) |  |

Decrypts the payload of the JWT

Parameters

  jwt | the jwt_t to decrypt
  privkey | the private key to decrypt cypher key, can be NULL if jwt already contains a private key
  x5u_flags | Flags to retrieve x5u certificates in privkey pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return an error

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_decrypt_verify_signature_nested()

int r_jwt_decrypt_verify_signature_nested | ( | jwt_t * | jwt,
|  | jwk_t * | verify_key,
|  | int | verify_key_x5u_flags,
|  | jwk_t * | decrypt_key,
|  | int | decrypt_key_x5u_flags
| ) |  |

Decrypts and verifies the signature of a nested JWT Fills the claims if the decryption and signature verifiation are succesfull

Parameters

  jwt | the jwt_t to decrypt and verify signature
  verify_key | the public key to check the signature, can be NULL if jws already contains a public key
  verify_key_x5u_flags | Flags to retrieve x5u certificates in verify_key pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return an error
  decrypt_key | the private key to decrypt cypher key, can be NULL if jwt already contains a private key
  decrypt_key_x5u_flags | Flags to retrieve x5u certificates in decrypt_key pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return an error

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_decrypt_nested()

int r_jwt_decrypt_nested | ( | jwt_t * | jwt,
|  | jwk_t * | decrypt_key,
|  | int | decrypt_key_x5u_flags
| ) |  |

Decrypts a nested JWT, do not verify the signature Fills the claims if the decryption is succesfull

Parameters

  jwt | the jwt_t to decrypt and verify signature
  decrypt_key | the private key to decrypt cypher key, can be NULL if jwt already contains a private key
  decrypt_key_x5u_flags | Flags to retrieve x5u certificates in decrypt_key pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return an error

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_verify_signature_nested()

int r_jwt_verify_signature_nested | ( | jwt_t * | jwt,
|  | jwk_t * | verify_key,
|  | int | verify_key_x5u_flags
| ) |  |

Verifies the signature of a nested JWT

Parameters

  jwt | the jwt_t to decrypt and verify signature
  verify_key | the public key to check the signature, can be NULL if jws already contains a public key
  verify_key_x5u_flags | Flags to retrieve x5u certificates in verify_key pointed by x5u if necessary, could be 0 if not needed Flags available are R_FLAG_IGNORE_SERVER_CERTIFICATE: ignrore if web server certificate is invalid R_FLAG_FOLLOW_REDIRECT: follow redirections if necessary R_FLAG_IGNORE_REMOTE: do not download remote key, but the function may return an error

Returns
  RHN_OK on success, an error value on error

## ◆ r_jwt_validate_claims()

int r_jwt_validate_claims | ( | jwt_t * | jwt,
|  |  | ...
| ) |  |

Validates the jwt claims with the list of expected claims given in parameters The list must end with the claim type R_JWT_CLAIM_NOP Claim types available

- R_JWT_CLAIM_ISS: claim "iss", values expected a string or NULL to validate the presence of the claim
- R_JWT_CLAIM_SUB: claim "sub", values expected a string or NULL to validate the presence of the claim
- R_JWT_CLAIM_AUD: claim "aud", values expected a string or NULL to validate the presence of the claim
- R_JWT_CLAIM_EXP: claim "exp", value expected R_JWT_CLAIM_NOW or an positive integer value or R_JWT_CLAIM_PRESENT to validate the presence of the claim
- R_JWT_CLAIM_NBF: claim "nbf", value expected R_JWT_CLAIM_NOW or an positive integer value or R_JWT_CLAIM_PRESENT to validate the presence of the claim
- R_JWT_CLAIM_IAT: claim "iat", value expected R_JWT_CLAIM_NOW or an positive integer value or R_JWT_CLAIM_PRESENT to validate the presence of the claim
- R_JWT_CLAIM_JTI: claim "jti", values expected a string or NULL to validate the presence of the claim
- R_JWT_CLAIM_STR: the claim name specified must have the string value expected or NULL to validate the presence of the claim
- R_JWT_CLAIM_INT: the claim name specified must have the integer value expected
- R_JWT_CLAIM_JSN: the claim name specified must have the json_t * value expected or NULL to validate the presence of the claim Example The following code will check the jwt agains the iss value "https://example.com", the sub value "client_1", the presence of the claim aud and that the claim exp is after now and the claim `nbf` is before now: if (r_jwt_validate_claims(jwt, R_JWT_CLAIM_ISS, "https://example.com", R_JWT_CLAIM_SUB, "client_1", R_JWT_CLAIM_AUD, NULL, R_JWT_CLAIM_EXP, R_JWT_CLAIM_NOW, R_JWT_CLAIM_NBF, R_JWT_CLAIM_NOW, R_JWT_CLAIM_STR, "scope", "scope1", R_JWT_CLAIM_INT, "age", 42, R_JWT_CLAIM_JSN, "verified", json_true(), R_JWT_CLAIM_NOP) == RHN_OK)