JSON Web Token Authentication

Table 2 HTTP Headers for JSON Web Token
Header Name	Description	Example
JWT header section
kid	Serial Number or thumbprint for merchant’s alias/CN name, corresponding to the key (.p12) used to digitally sign the JWS. Optional.	5015325034050177096965
x5c	The "x5c" (X.509 certificate chain) Header Parameter contains the X.509 public key certificate or certificate chain corresponding to the key(.p12) used to digitally sign the JWS. Required.	MIICZTCCAc6gAwIBAgIWNTAxNTMyNTAzNDA1MDE3NzA5Njk2NTANBgkqhkiG9w0B AQsFADAeMRwwGgYDVQQDDBNDeWJlclNvdXJjZUNlcnRBdXRoMB4XDTE3MDczMTIw MjE0M1oXDTE5MDczMTIwMjE0M1owOjEXMBUGA1UEAwwOcmVzdG1lcmNoX2FjY3Qx HzAdBgNVBAUTFjUwMTUzMjUwMzQwNTAxNzcwOTY5NjUwggEiMA0GCSqGSIb3DQEB AQUAA4IBDwAwggEKAoIBAQC+BtdMcokaKwTes9O+snqjWsehO0/Y4CJrwo4cdGCa fRO6ows3mC1xmpSYttTKIdeGR1qOYpTSeY9uJh2cCfayMKXmhQf4d5v8pNDnmYBM GBwU1wWjlYsMLFbcPFWjdPtKlou2RIWZ566YWIbWCBf+G4dHkA0D7Csp3FT3lnUN 2me4lJklysfqp1X8q3JDqVIQFVAduamhWCYMRS5Kg8sKwMjldGQUby88S+MOwcCA 3HOHT64barvPId2ExqAqvfyBCPAR49V6/ywDVsH9SyHewg121ckMcA9g55tIqdsy HGRZN9fs20kMyqEP78L4cxfisuVQC8knlfZtdcqVAY7FAgMBAAEwDQYJKoZIhvcN AQELBQADgYEAZ9NWN0BNVEhtVLqldmEfMRqJCqfzFNq1UyQEu3CJOjPhN9dYq8Jl aD6d1mRpybeaclvHN/F/06RjZW9zujlDFE3X0qanU3Rkj7nStiDUEmj0F35Ew2ek 4VezUXnZ/SMLvWEA6DG2sjSFCCuIot3mLJ3lI4AQSQSBSazhQec75Rk=
alg	Identifier of the hashing algorithm. Required.	RS256
v-c-merchant-id	Merchant ID assigned in the CyberSource Business Center. Required.	v-c-merchant-id: restmercht_id
JWT payload section
iat	The date and time that the message was originated. Date can be in any for timezone. HTTP-date format is defined by RFC7231: String gmtDateTime = DateTimeFormatter.RFC_1123_DATE_TIME.format(ZonedDateTime.now(ZoneId.of("GMT"))); Required.	iat: Thru, 15 June 2017 08:12:31 GMT
Digest	SHA256 encryption of the payload that is Base64 encoded. Required.	example_payload: { "profileId": "11111111-1111-1111-1111-111111111111", "encryptionType": "RsaOaep256" } SHA256_hash_of_example_payload = 2b4fee10da8c5e1feaad32b014021e079fe4afcf06af223004af944011a7cb65c # The hash has Base64 encoded Digest header in RFC3230 defined format of "Digest: HASH-ALG=BASE64(SHA56_hash_of_example_payload)“ = tP7hDajF4f6q0ysBQCHgef5K/PBq8iMASvlEARp8tl= Digest: tP7hDajF4f6q0ysBQCHgef5K/PBq8iMASvlEARp8tl= Code Snippet: MessageDigest signatureString = MessageDigest.getInstance("SHA-256"); byte[] digestBytes = signatureString.digest(messageBody.getBytes()); String bluePrint = Base64.getEncoder().encodeToString(digestBytes);
digestAlgorithm	Signature algorithm used. SHA256 if an asymmetric key is used. Required.	digestAlgorithm: SHA-256
Signature and token
Signature	The header and the payload created is BASE64 Encoded. Join the resulting encoded strings together with a period (.) in between them. In our pseudo code, this joined string is assigned to data. To get the JWT signature, the data string is hashed with RS256, with the secret key using the hashing algorithm specified in the JWT header. Required.	// signature algorithm data = base64urlEncode( header ) + “.” + base64urlEncode( payload ) signature = RS256Hash( data, secret ) ;
JWT Token	With All three components, We can create JWT token = header.payload.signature Combine the header and payload and signature with periods (.) separating them. We use the base64url encoded versions of the header and of the payload, and the signature.	JWT Token = base64url(header) + “.” + base64url(payload) + “.” + base64url(Signature) // header eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9 // payload eyJ1c2VySWQiOiJiMDhmODZhZi0zNWRhLTQ4ZjItOGZhYi1jZWYzOTA0NjYwYmQifQ // signature -xN_h82PHVTCMA9vdoHrcZxH-x5mb11y1537t3rGzcM // JWT Token eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJiMDhmODZhZi0zNWRhLTQ4ZjItOGZhYi1jZWYzOTA0NjYwYmQifQ.-xN_h82PHVTCMA9vdoHrcZxH-x5mb11y1537t3rGzc

private sign(String content, PrivateKey privateKey, X509Certificate x509Certificate, Map<String, ? extends Object> customHeaders) {
if(!this.isNullOrEmpty(content) && x509Certificate != null && privateKey != null) {
String serialNumber = null;
String serialNumberPrefix = "SERIALNUMBER=";
String principal = x509Certificate.getSubjectDN().getName().toUpperCase();
int beg = principal.indexOf(serialNumberPrefix);
if(beg >= 0) {
int x5cBase64List = principal.indexOf(",", beg);
if(x5cBase64List == -1) {
x5cBase64List = principal.length();
}

serialNumber = principal.substring(beg + serialNumberPrefix.length(), x5cBase64List);
} else {
serialNumber = x509Certificate.getSerialNumber().toString();
}

ArrayList x5cBase64List1 = new ArrayList();

try {
x5cBase64List1.add(Base64.encode(x509Certificate.getEncoded()));
} catch (CertificateEncodingException var16) {
logger.error("can\'t signAndEncrypt the payload", var16);
return null;
}

RSAPrivateKey rsaPrivateKey = (RSAPrivateKey)privateKey;
Payload payload = new Payload(content);
JWSHeader jwsHeader = (new com.nimbusds.jose.JWSHeader.Builder(JWSAlgorithm.RS256)).customParams(customHeaders).keyID(serialNumber).x509CertChain(x5cBase64List1).build();
JWSObject jwsObject = new JWSObject(jwsHeader, payload);

try {
RSASSASigner joseException = new RSASSASigner(rsaPrivateKey);
jwsObject.sign(joseException);
if(!jwsObject.getState().equals(com.nimbusds.jose.JWSObject.State.SIGNED)) {
logger.error("Payload signing failed.");
return null;
} else {
return jwsObject;
}
} catch (JOSEException var15) {
logger.error("can\'t signAndEncrypt the payload", var15);
return null;
}
} else {
logger.error("empty or null content or Private key or public certificate is null");
return null;
}
}