JwtParser needs a setVerifyingKey API

The token signature validation requires the caller to specify a signing key. It does not make it obvious that this is a verify operation.

JwtParser setSigningKey(byte[] key);

JwtParser setSigningKey(String base64EncodedKeyBytes);

JwtParser setSigningKey(Key key);

In RsaSignatureValidator, the isValid method does a signature verification if the passed key is an instance of type PublicKey. If passed an instance of type PrivateKey, it signs the data again and compares signature.

But at JWTParser layer, the following APIs will provide a more clear description of the operation:

JwtParser setVerifyingKey(byte[] verifyingKey);

JwtParser setVerifyingKey(String base64EncodedVerifyKeyBytes);

JwtParser setVerifyingKey(PublicKey publicKey);

However setSigningKey keys has to be retained for backward compatibility.

setVerifyingKey can also help scenarios where a token issuer service is different from a token validator, and the private key need not to be shared among them.

[lhazlewood]

This is better self-documenting - I think it’s a good addition. Thanks for the issue!

[lhazlewood]

Just noting that this isn’t as simple as expected: the SigningKeyResolver interface, its adapter, and anything else referencing such needs to be refactored. This is a change that’s probably better left for 1.0 (or at least a release after the more urgent 0.10.0 release).