kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libekmfweb: Allow to check if a JSON Web Token (JWT) is expired

Browse Source 
When login in with EKMF Web, a bearer token is retrieved from EKMF Web
which is then used on subsequent requests to authenticate with EKMF Web.
Such a bearer token is valid for several minutes, thus no re-login is
required during that time. The bearer token contains a JSON Web Token
(JWT, see RFC7519).

Allow to check such a token if it is still valid, or already expired.
That way a client application can check the token before issuing the next
request, and re-login if needed.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2020-04-07 16:07:01 +02:00
committed by Jan Höppner
parent cbf7f02d69
commit d8089e69fa
5 changed files with 524 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
include/ekmfweb/ekmfweb.h
View File

@@ -45,6 +45,9 @@ struct ekmf_config {
/** Maximum number of redirects to follow. Zero means that redirects are
* not followed. -1 means to infinitely follow redirects. */
long max_redirs;
/** File name of the login token (JSON Web Token) used for the last
* login. */
const char *login_token;
};
/**
@@ -88,4 +91,25 @@ int ekmf_get_server_cert_chain(const struct ekmf_config *config,
*/
int ekmf_print_certificates(const char *cert_pem, bool verbose);
/**
* Checks if the login token stored in the file denoted by field login_token
* of the config structure is valid or not. The file (if existent) contains a
* JSON Web Token (JWT, see RFC7519). It is valid if the current date and time
* is before its expiration time ("exp" claim), and after or equal its
* not-before time ("nbf" claim).
* Note: The signature (if any) of the JWT is not checked, nor any other JWT
* fields.
*
* @param config the configuration structure
* @param valid On return: true if the token is valid, false if not
* @param login_token On return: If not NULL: the login token, if the
* token is still valid. The returned string must
* be freed by the caller when no longer needed.
* @param verbose if true, verbose messages are printed
*
* @returns a negative errno in case of an error, 0 if success.
*/
int ekmf_check_login_token(const struct ekmf_config *config, bool *valid,
char **login_token, bool verbose);
#endif