/**
* Verifies the id token, returns the verified token contents.
*
* @param $jwt string the token
* @param $certs array of certificates
* @param $required_audience string the expected consumer of the token
* @param [$issuer] the expected issues, defaults to Google
* @param [$max_expiry] the max lifetime of a token, defaults to MAX_TOKEN_LIFETIME_SECS
* @throws Postman_Google_Auth_Exception
* @return mixed token information if valid, false if not
*/
public function verifySignedJwtWithCerts($jwt, $certs, $required_audience, $issuer = null, $max_expiry = null)
{
if (!$max_expiry) {
// Set the maximum time we will accept a token for.
$max_expiry = self::MAX_TOKEN_LIFETIME_SECS;
}
$segments = explode(".", $jwt);
if (count($segments) != 3) {
throw new Postman_Google_Auth_Exception("Wrong number of segments in token: {$jwt}");
}
$signed = $segments[0] . "." . $segments[1];
$signature = Postman_Google_Utils::urlSafeB64Decode($segments[2]);
// Parse envelope.
$envelope = json_decode(Postman_Google_Utils::urlSafeB64Decode($segments[0]), true);
if (!$envelope) {
throw new Postman_Google_Auth_Exception("Can't parse token envelope: " . $segments[0]);
}
// Parse token
$json_body = Postman_Google_Utils::urlSafeB64Decode($segments[1]);
$payload = json_decode($json_body, true);
if (!$payload) {
throw new Postman_Google_Auth_Exception("Can't parse token payload: " . $segments[1]);
}
// Check signature
$verified = false;
foreach ($certs as $keyName => $pem) {
$public_key = new Postman_Google_Verifier_Pem($pem);
if ($public_key->verify($signed, $signature)) {
$verified = true;
break;
}
}
if (!$verified) {
throw new Postman_Google_Auth_Exception("Invalid token signature: {$jwt}");
}
// Check issued-at timestamp
$iat = 0;
if (array_key_exists("iat", $payload)) {
$iat = $payload["iat"];
}
if (!$iat) {
throw new Postman_Google_Auth_Exception("No issue time in token: {$json_body}");
}
$earliest = $iat - self::CLOCK_SKEW_SECS;
// Check expiration timestamp
$now = time();
$exp = 0;
if (array_key_exists("exp", $payload)) {
$exp = $payload["exp"];
}
if (!$exp) {
throw new Postman_Google_Auth_Exception("No expiration time in token: {$json_body}");
}
if ($exp >= $now + $max_expiry) {
throw new Postman_Google_Auth_Exception(sprintf("Expiration time too far in future: %s", $json_body));
}
$latest = $exp + self::CLOCK_SKEW_SECS;
if ($now < $earliest) {
throw new Postman_Google_Auth_Exception(sprintf("Token used too early, %s < %s: %s", $now, $earliest, $json_body));
}
if ($now > $latest) {
throw new Postman_Google_Auth_Exception(sprintf("Token used too late, %s > %s: %s", $now, $latest, $json_body));
}
$iss = $payload['iss'];
if ($issuer && $iss != $issuer) {
throw new Postman_Google_Auth_Exception(sprintf("Invalid issuer, %s != %s: %s", $iss, $issuer, $json_body));
}
// Check audience
$aud = $payload["aud"];
if ($aud != $required_audience) {
throw new Postman_Google_Auth_Exception(sprintf("Wrong recipient, %s != %s:", $aud, $required_audience, $json_body));
}
// All good.
return new Postman_Google_Auth_LoginTicket($envelope, $payload);
}
/**
* Most of the logic for ID token validation is in AuthTest -
* this is just a general check to ensure we verify a valid
* id token if one exists.
*/
public function testValidateIdToken()
{
if (!$this->checkToken()) {
return;
}
$client = $this->getClient();
$token = json_decode($client->getAccessToken());
$segments = explode(".", $token->id_token);
$this->assertEquals(3, count($segments));
// Extract the client ID in this case as it wont be set on the test client.
$data = json_decode(Postman_Google_Utils::urlSafeB64Decode($segments[1]));
$oauth = new Postman_Google_Auth_OAuth2($client);
$ticket = $oauth->verifyIdToken($token->id_token, $data->aud);
$this->assertInstanceOf("Postman_Google_Auth_LoginTicket", $ticket);
$this->assertTrue(strlen($ticket->getUserId()) > 0);
// TODO(ianbarber): Need to be smart about testing/disabling the
// caching for this test to make sense. Not sure how to do that
// at the moment.
$client = $this->getClient();
$client->setIo(new Postman_Google_IO_Stream($client));
$data = json_decode(Postman_Google_Utils::urlSafeB64Decode($segments[1]));
$oauth = new Postman_Google_Auth_OAuth2($client);
$this->assertInstanceOf("Postman_Google_Auth_LoginTicket", $oauth->verifyIdToken($token->id_token, $data->aud));
}
