...

BouncyCastle provider can be registered and unregistered as follows:

import java.security.Security;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

private static void registerBouncyCastle() throws Exception {
    Security.addProvider(new BouncyCastleProvider());    
}

private static void unregisterBouncyCastle() throws Exception {
    Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);    
}

...

JWT (JSON Web Token) is a collection of claims in JSON format. It offers is simply a standard JSON container for representing various properties or claimsregular JSON document where each top elevel property is called a 'claim'.

JWT can be JWS signed and/or encrypted, i.e, serve as a JOSE signature or encryption input JWE encrypted like any other data structure.

JWT has been primarily is mainly used in OAuth2 and OIDC applications to represent self-contained OAuth2 access tokens, OIDC IdToken, UserInfo, but can also be used in other contexts. For example, see the section below on linking JWT authentication tokens to JWS or JWE secured payloads.

CXF offers an initial a JWT support in this package.

JOSE JAX-RS Filters

JWS

JWE

Typically one would create a set of claims and submit them to JWS/JWE JWT processors, for example, see a JWS section above.

JWS and JWE Combined

If you have a requirement to sign the data and then encrypt the signed payload then it can be easily achieved by selecting a required JWS Producer and creating a JWS Compact sequence, and next submitting this sequence to a JWE producer, and processing it all in the reverse sequence

JOSE JAX-RS Filters

JWS

JWE

Linking JWT authentications to JWS or JWE content

...

The above code needs to be executed in the context of the current request (in server or client in/out interceptors or server service code) as it expects the current CXF Message be available in order to deduce where to load the configuration properties from. However JwsUtils and JweUtils provide a number of utility methods for loading the providers without loading the properties first which can be used when setting up the client code or when no properties are available in the current request context.

...

When the code needs to load the configuration properties it first looks for the property 'container' file which contains the specific properties instructing which keys and algorithms need to be used. Singature or encryption properties for in/out operations can be provided.  

Configuration Property Containers

Signature

Encryption

Configuration that applies to signature only

Once the properties are loaded the runtime proceeds with initializing JWS/JWE providers accordingly. The following section lists the properties, some oif them being common and some - unique to the signature/verification and encryption/decryption processes.

Note that one can override some of the properties, for example, 'rs.security.store' can be set as a dynamic request property pointing to a preloaded Java KeyStore object.

Configuration that applies to both encryption and signature

Configuration that applies to

...

signature only

Configuration that applies to encryption only

...

Interoperability

...

Third-Party Libraries

Jose4J

...