KeyProvider-style API for signature schemes (HMAC)

Open
#673 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
java
Domain
authentication

Research direction

Start with the KeyProvider API and HMACAlgorithm, then review README, EXAMPLES.md, and the API documentation to compare the existing asymmetric flow with HMAC. Define the proposed symmetric-key provider behavior, including key IDs and claims validation, and document how the API would support key rotation before implementation.

Written by the indexing model from the issue text.

Description

feature request
Checklist
  • I have looked into the Readme and Examples, and have not found a suitable solution or answer.
  • I have looked into the API documentation and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.
Describe the problem you'd like to have solved

I am working on a project just for fun to learn a little more about JWTs

There is a handy KeyProvider API for asymmetric encryption schemes that allow identifying keys by a KID and validating a claims from a set of potential keys. A similar API for HMAC (which has no public key) is not available.

KeyIDs are handy when setting up secret key rotation, so an equivalent API for HMAC would be handy.

Describe the ideal solution

A KeyProvider-style API specifically for HMAC which does away with the public key part aspect and solely focuses on keys with only a private portion (could also cover symmetric keys).

Alternatives and current workarounds

I considered extending HMACAlgorithm to do this, but all the relevant classes are locked down.

Additional context

None

Dominant language
Java
Stars
6.2k
Forks
945
Avg merge
2d 15h
Merged PRs (30d)
4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from auth0/java-jwt

All issues in auth0/java-jwt

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.