java - 如何使用 Java 从苹果 p8 文件解析 jwt 签名 key

Question

现在我想生成一个 JWT token 来请求苹果服务器遵循这个 docs ，我有从苹果下载的 p8 文件，如何从 p8 文件中获取 jwt 签名 key ？这是我的 jwt token 生成代码:

Map<String,Object> jwtHeader = new HashMap<>();
        jwtHeader.put("alg","ES256");
        jwtHeader.put("kid","YDKL424AF9");
        jwtHeader.put("typ","JWT");
        Map<String,Object> appleJwtPayload = new HashMap<>();
        appleJwtPayload.put("iss","5fb8e836-27d7-4390-8f40-008acd64a29d");
        appleJwtPayload.put("iat",System.currentTimeMillis() / 1000L);
        appleJwtPayload.put("exp",System.currentTimeMillis() / 1000L + 60 * 15);
        appleJwtPayload.put("aud","appstoreconnect-v1");
        appleJwtPayload.put("nonce",UUID.randomUUID().toString());
        appleJwtPayload.put("bid","com.earth.dolphin");
        String appleKey = "<how to get the apple key>";
        SecretKey secretKey = new SecretKeySpec(appleKey.getBytes(), SignatureAlgorithm.ES256.getJcaName());
        String accessToken = Jwts.builder()
                .setClaims(appleJwtPayload)
                .setHeader(jwtHeader)
                .signWith(secretKey)
                .compact();

我按照 this question 阅读了 KeyStore 代码, 但我仍然不知道该怎么做，有人可以帮助我吗？

Answer 1

像这样获取签名 key :

byte[] p8der = Files.readAllBytes(Path.of("/opt/apps/dolphin-post/AuthKey_YDKL424AF9.p8"));
PKCS8EncodedKeySpec priPKCS8 = new PKCS8EncodedKeySpec(new org.apache.commons.codec.binary.Base64().decode(p8der));
PrivateKey appleKey = KeyFactory.getInstance("EC").generatePrivate(priPKCS8);

AuthKey_YDKL424AF9.p8 文件是从 apple 下载的，您应该删除文件的开始和结束 header 。这是我获取私钥的完整功能:

public static PrivateKey getPrivateKey(String filename, String algorithm) throws IOException {
        String content = new String(Files.readAllBytes(Paths.get(filename)), "utf-8");
        try {
            String privateKey = content.replace("-----BEGIN PRIVATE KEY-----", "")
                    .replace("-----END PRIVATE KEY-----", "")
                    .replaceAll("\\s+", "");

            KeyFactory kf = KeyFactory.getInstance(algorithm);
            return kf.generatePrivate(new PKCS8EncodedKeySpec(Base64.getDecoder().decode(privateKey)));
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("Java did not support the algorithm:" + algorithm, e);
        } catch (InvalidKeySpecException e) {
            throw new RuntimeException("Invalid key format");
        }
    }

你可以这样使用它:

PrivateKey appleKey = SecurityUtil.getPrivateKey(APPLE_PRIVATE_KEY_PATH,"EC");

我操作系统中的 APPLE_PRIVATE_KEY_PATH 是:

apple.private.key.path=/opt/apps/dolphin-post/AuthKey.p8

将其更改为您的路径。