Repository: SAP/cloud-security-xsuaa-integration
Pull request #224 (2020-02-10 12:31:20)

Sets when data is unique
Enforcing uniqueness in data lists by using sets. 


Patch:
diff --git a/java-security/src/main/java/com/sap/cloud/security/adapter/spring/SAPOfflineTokenServicesCloud.java b/java-security/src/main/java/com/sap/cloud/security/adapter/spring/SAPOfflineTokenServicesCloud.java
index 49fdf2f1..096f502c 100644
--- a/java-security/src/main/java/com/sap/cloud/security/adapter/spring/SAPOfflineTokenServicesCloud.java
+++ b/java-security/src/main/java/com/sap/cloud/security/adapter/spring/SAPOfflineTokenServicesCloud.java
@@ -21,12 +21,15 @@ import org.springframework.web.client.RestOperations;
 import org.springframework.web.client.RestTemplate;
 
 import javax.annotation.Nonnull;
-import java.util.*;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Set;
 import java.util.stream.Collectors;
 
 /**
  * This constructor requires a dependency to Spring oauth.
- * 
+ *
  * <pre>
  * {@code
  * <dependency>
@@ -108,9 +111,9 @@ public class SAPOfflineTokenServicesCloud implements ResourceServerTokenServices
 			throws AuthenticationException, InvalidTokenException {
 		Token token = checkAndCreateToken(accessToken);
 
-		List<String> scopes = token instanceof AccessToken
+		Set<String> scopes = token instanceof AccessToken
 				? ((AccessToken) token).getScopes()
-				: Collections.EMPTY_LIST;
+				: Collections.emptySet();
 		if (useLocalScopeAsAuthorities) {
 			scopes = xsuaaScopeConverter.convert(scopes);
 		}
diff --git a/java-security/src/main/java/com/sap/cloud/security/adapter/xs/XSUserInfoAdapter.java b/java-security/src/main/java/com/sap/cloud/security/adapter/xs/XSUserInfoAdapter.java
index b8aa6737..bdf68e8a 100644
--- a/java-security/src/main/java/com/sap/cloud/security/adapter/xs/XSUserInfoAdapter.java
+++ b/java-security/src/main/java/com/sap/cloud/security/adapter/xs/XSUserInfoAdapter.java
@@ -1,5 +1,6 @@
 package com.sap.cloud.security.adapter.xs;
 
+import com.sap.cloud.security.config.Environment;
 import com.sap.cloud.security.config.Environments;
 import com.sap.cloud.security.config.OAuth2ServiceConfiguration;
 import com.sap.cloud.security.config.cf.CFConstants;
diff --git a/java-security/src/main/java/com/sap/cloud/security/servlet/AbstractTokenAuthenticator.java b/java-security/src/main/java/com/sap/cloud/security/servlet/AbstractTokenAuthenticator.java
index 5916214b..1251a2a3 100644
--- a/java-security/src/main/java/com/sap/cloud/security/servlet/AbstractTokenAuthenticator.java
+++ b/java-security/src/main/java/com/sap/cloud/security/servlet/AbstractTokenAuthenticator.java
@@ -98,7 +98,7 @@ public abstract class AbstractTokenAuthenticator implements TokenAuthenticator {
 	 */
 	protected abstract Token extractFromHeader(String authorizationHeader);
 
-	private Validator<Token> getOrCreateTokenValidator() {
+	protected Validator<Token> getOrCreateTokenValidator() {
 		if (tokenValidator == null) {
 			JwtValidatorBuilder jwtValidatorBuilder = JwtValidatorBuilder.getInstance(getServiceConfiguration())
 					.withHttpClient(httpClient);
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/AbstractToken.java b/java-security/src/main/java/com/sap/cloud/security/token/AbstractToken.java
index 9c473ea4..dd804af8 100644
--- a/java-security/src/main/java/com/sap/cloud/security/token/AbstractToken.java
+++ b/java-security/src/main/java/com/sap/cloud/security/token/AbstractToken.java
@@ -12,9 +12,12 @@ import java.security.Principal;
 import java.time.Instant;
 import java.time.LocalDateTime;
 import java.time.ZoneOffset;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Objects;
+import java.util.Set;
 import java.util.regex.Pattern;
+import java.util.stream.Collectors;
 
 import static com.sap.cloud.security.token.TokenClaims.EXPIRATION;
 import static com.sap.cloud.security.token.TokenClaims.NOT_BEFORE;
@@ -108,8 +111,10 @@ public abstract class AbstractToken implements Token {
 	}
 
 	@Override
-	public List<String> getAudiences() {
-		return getClaimAsStringList(TokenClaims.AUDIENCE);
+	public Set<String> getAudiences() {
+		Set<String> audiences = new LinkedHashSet<>();
+		audiences.addAll(getClaimAsStringList(TokenClaims.AUDIENCE));
+		return audiences;
 	}
 
 	protected Principal createPrincipalByName(String name) {
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/AccessToken.java b/java-security/src/main/java/com/sap/cloud/security/token/AccessToken.java
index d7af1687..4f484b45 100644
--- a/java-security/src/main/java/com/sap/cloud/security/token/AccessToken.java
+++ b/java-security/src/main/java/com/sap/cloud/security/token/AccessToken.java
@@ -2,7 +2,7 @@ package com.sap.cloud.security.token;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
-import java.util.List;
+import java.util.Set;
 
 /**
  * Represents an access token in the format of a JSON Web Token (not a short opaque token).
@@ -16,7 +16,7 @@ public interface AccessToken extends Token {
 	 *
 	 * @return the list of the claim scope or empty list.
 	 */
-	List<String> getScopes();
+	Set<String> getScopes();
 
 	/**
 	 * Checks if a scope is available in the access token.
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/SapIdToken.java b/java-security/src/main/java/com/sap/cloud/security/token/SapIdToken.java
index 94a35878..a5c23200 100644
--- a/java-security/src/main/java/com/sap/cloud/security/token/SapIdToken.java
+++ b/java-security/src/main/java/com/sap/cloud/security/token/SapIdToken.java
@@ -7,8 +7,8 @@ import com.sap.cloud.security.xsuaa.jwt.DecodedJwt;
 import javax.annotation.Nonnull;
 
 import java.security.Principal;
-import java.util.Arrays;
-import java.util.List;
+import java.util.LinkedHashSet;
+import java.util.Set;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -39,11 +39,13 @@ public class SapIdToken extends AbstractToken {
 	}
 
 	@Override
-	public List<String> getAudiences() {
+	public Set<String> getAudiences() {
 		try {
 			return super.getAudiences();
 		} catch (JsonParsingException e) {
-			return Arrays.asList(getClaimAsString(TokenClaims.AUDIENCE));
+			final Set<String> audiences = new LinkedHashSet<>();
+			audiences.add(getClaimAsString(TokenClaims.AUDIENCE));
+			return audiences;
 		}
 	}
 }
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/ScopeConverter.java b/java-security/src/main/java/com/sap/cloud/security/token/ScopeConverter.java
index f0760809..d9c2d0ad 100644
--- a/java-security/src/main/java/com/sap/cloud/security/token/ScopeConverter.java
+++ b/java-security/src/main/java/com/sap/cloud/security/token/ScopeConverter.java
@@ -1,8 +1,8 @@
 package com.sap.cloud.security.token;
 
 import java.util.Collection;
-import java.util.List;
+import java.util.Set;
 
 public interface ScopeConverter {
-	List<String> convert(Collection<String> scopes);
+	Set<String> convert(Collection<String> scopes);
 }
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/Token.java b/java-security/src/main/java/com/sap/cloud/security/token/Token.java
index 4a79b258..e43c504b 100644
--- a/java-security/src/main/java/com/sap/cloud/security/token/Token.java
+++ b/java-security/src/main/java/com/sap/cloud/security/token/Token.java
@@ -9,6 +9,7 @@ import javax.annotation.Nullable;
 import java.security.Principal;
 import java.time.Instant;
 import java.util.List;
+import java.util.Set;
 
 /**
  * Represents a JSON Web Token (JWT).
@@ -139,5 +140,5 @@ public interface Token {
 	 *
 	 * @return the audiences.
 	 **/
-	List<String> getAudiences();
+	Set<String> getAudiences();
 }
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/XsuaaScopeConverter.java b/java-security/src/main/java/com/sap/cloud/security/token/XsuaaScopeConverter.java
index eff5d780..a646992e 100644
--- a/java-security/src/main/java/com/sap/cloud/security/token/XsuaaScopeConverter.java
+++ b/java-security/src/main/java/com/sap/cloud/security/token/XsuaaScopeConverter.java
@@ -3,8 +3,9 @@ package com.sap.cloud.security.token;
 import com.sap.cloud.security.xsuaa.Assertions;
 
 import java.util.Collection;
-import java.util.List;
+import java.util.LinkedHashSet;
 import java.util.Objects;
+import java.util.Set;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -28,11 +29,15 @@ public class XsuaaScopeConverter implements ScopeConverter {
 	}
 
 	@Override
-	public List<String> convert(Collection<String> scopes) {
-		return scopes.stream()
-				.map(this::convertToLocalScope)
-				.filter(Objects::nonNull)
-				.collect(Collectors.toList());
+	public Set<String> convert(Collection<String> scopes) {
+		Set<String> convertedScopes = new LinkedHashSet<>();
+		for (String scope : scopes) {
+			String convertedScope = convertToLocalScope(scope);
+			if (convertedScope != null) {
+				convertedScopes.add(convertedScope);
+			}
+		}
+		return convertedScopes;
 	}
 
 	private String convertToLocalScope(String scope) {
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/XsuaaToken.java b/java-security/src/main/java/com/sap/cloud/security/token/XsuaaToken.java
index afd69f12..3f2a52d7 100644
--- a/java-security/src/main/java/com/sap/cloud/security/token/XsuaaToken.java
+++ b/java-security/src/main/java/com/sap/cloud/security/token/XsuaaToken.java
@@ -7,7 +7,9 @@ import com.sap.cloud.security.xsuaa.jwt.DecodedJwt;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import java.security.Principal;
-import java.util.List;
+import java.util.LinkedHashSet;
+import java.util.Set;
+import java.util.stream.Collectors;
 
 import static com.sap.cloud.security.token.TokenClaims.USER_NAME;
 import static com.sap.cloud.security.token.TokenClaims.XSUAA.*;
@@ -82,8 +84,10 @@ public class XsuaaToken extends AbstractToken implements AccessToken {
 	}
 
 	@Override
-	public List<String> getScopes() {
-		return getClaimAsStringList(TokenClaims.XSUAA.SCOPES);
+	public Set<String> getScopes() {
+		LinkedHashSet<String> scopes = new LinkedHashSet<>();
+		scopes.addAll(getClaimAsStringList(TokenClaims.XSUAA.SCOPES));
+		return scopes;
 	}
 
 	@Override
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidator.java b/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidator.java
index 63f769b5..c5bb066a 100644
--- a/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidator.java
+++ b/java-security/src/main/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidator.java
@@ -10,8 +10,8 @@ import com.sap.cloud.security.token.validation.Validator;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import java.util.ArrayList;
-import java.util.List;
+import java.util.LinkedHashSet;
+import java.util.Set;
 
 /**
  * Validates if the jwt access token is intended for the OAuth2 client of this
@@ -25,7 +25,7 @@ public class JwtAudienceValidator implements Validator<Token> {
 	private static final Logger logger = LoggerFactory.getLogger(JwtAudienceValidator.class);
 	private static final char DOT = '.';
 
-	private final List<String> clientIds = new ArrayList();
+	private final Set<String> clientIds = new LinkedHashSet<>();
 
 	JwtAudienceValidator(String clientId) {
 		configureTrustedClientId(clientId);
@@ -41,7 +41,7 @@ public class JwtAudienceValidator implements Validator<Token> {
 
 	@Override
 	public ValidationResult validate(Token token) {
-		List<String> allowedAudiences = getAllowedAudiences(token);
+		Set<String> allowedAudiences = getAllowedAudiences(token);
 		for (String configuredClientId : clientIds) {
 			if (allowedAudiences.contains(configuredClientId)) {
 				return ValidationResults.createValid();
@@ -59,8 +59,8 @@ public class JwtAudienceValidator implements Validator<Token> {
 	 * @param token
 	 * @return (empty) list of audiences
 	 */
-	static List<String> getAllowedAudiences(Token token) {
-		List<String> audiences = new ArrayList<>();
+	static Set<String> getAllowedAudiences(Token token) {
+		Set<String> audiences = new LinkedHashSet<>();
 
 		for (String audience : token.getAudiences()) {
 			if (audience.contains(".")) {
diff --git a/token-client/src/main/java/com/sap/cloud/security/xsuaa/jwt/JwtSignatureAlgorithm.java b/token-client/src/main/java/com/sap/cloud/security/xsuaa/jwt/JwtSignatureAlgorithm.java
index d584ba0f..70440e6d 100644
--- a/token-client/src/main/java/com/sap/cloud/security/xsuaa/jwt/JwtSignatureAlgorithm.java
+++ b/token-client/src/main/java/com/sap/cloud/security/xsuaa/jwt/JwtSignatureAlgorithm.java
@@ -5,7 +5,7 @@ package com.sap.cloud.security.xsuaa.jwt;
  * https://www.rfc-editor.org/rfc/rfc7518.html#section-6.1
  */
 public enum JwtSignatureAlgorithm {
-	RS256("RSA", "RS256", "SHA256withRSA")/*, ES256("EC", "ES256", "SHA256withECDSA")// Eliptic curve */;
+	RS256("RSA", "RS256", "SHA256withRSA"), ES256("EC", "ES256", "SHA256withECDSA"); // Eliptic curve
 
 	private final String type;
 	private final String value;


Test patch:
diff --git a/java-security-test/src/main/java/com/sap/cloud/security/test/JwtGenerator.java b/java-security-test/src/main/java/com/sap/cloud/security/test/JwtGenerator.java
index 8c9e4f17..ede84ea3 100644
--- a/java-security-test/src/main/java/com/sap/cloud/security/test/JwtGenerator.java
+++ b/java-security-test/src/main/java/com/sap/cloud/security/test/JwtGenerator.java
@@ -20,6 +20,7 @@ import javax.annotation.Nonnull;
 import java.security.*;
 import java.time.Instant;
 import java.util.*;
+import java.util.stream.Collectors;
 
 /**
  * Jwt {@link Token} builder class to generate tokes for testing purposes.
@@ -33,7 +34,8 @@ public class JwtGenerator {
 
 	private final JSONObject jsonHeader = new JSONObject();
 	private final JSONObject jsonPayload = new JSONObject();
-	private final List<String> unsupportedClaims = Arrays.asList(AUDIENCE);
+	private final Set<String> unsupportedClaims = Arrays.asList(AUDIENCE).stream().collect(Collectors.toSet());
+
 	private SignatureCalculator signatureCalculator;
 	private Service service;
 
diff --git a/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidatorTest.java b/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidatorTest.java
index 8c494dd8..4a244ae3 100644
--- a/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidatorTest.java
+++ b/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtAudienceValidatorTest.java
@@ -2,6 +2,7 @@ package com.sap.cloud.security.token.validation.validators;
 
 import com.sap.cloud.security.token.Token;
 import com.sap.cloud.security.token.validation.ValidationResult;
+import org.assertj.core.util.Sets;
 import org.junit.Before;
 import org.junit.Test;
 import org.mockito.Mockito;
@@ -18,7 +19,8 @@ public class JwtAudienceValidatorTest {
 	@Before
 	public void setUp() {
 		token = Mockito.mock(Token.class);
-		Mockito.when(token.getAudiences()).thenReturn(Arrays.asList("client", "foreignclient", "sb-test4!t1.data"));
+		Mockito.when(token.getAudiences()).thenReturn(
+				Sets.newLinkedHashSet("client", "foreignclient", "sb-test4!t1.data"));
 	}
 
 	@Test
@@ -41,7 +43,7 @@ public class JwtAudienceValidatorTest {
 	@Test
 	public void validate_clientIdMatchesTokenAudienceWithoutDot() {
 		// configures token audience
-		Mockito.when(token.getAudiences()).thenReturn(Arrays.asList("client", "foreignclient", "sb-test4!t1.data.x"));
+		Mockito.when(token.getAudiences()).thenReturn(Sets.newLinkedHashSet("client", "foreignclient", "sb-test4!t1.data.x"));
 
 		// configures audience validator with client-id from VCAP_SERVICES
 		ValidationResult result = new JwtAudienceValidator("sb-test4!t1")
@@ -64,7 +66,7 @@ public class JwtAudienceValidatorTest {
 
 	@Test
 	public void validationShouldFilterEmptyAudiences() {
-		Mockito.when(token.getAudiences()).thenReturn(Arrays.asList(".", "test.", " .test2"));
+		Mockito.when(token.getAudiences()).thenReturn(Sets.newLinkedHashSet(".", "test.", " .test2"));
 
 		ValidationResult result = new JwtAudienceValidator("any")
 				.validate(token);
@@ -76,7 +78,7 @@ public class JwtAudienceValidatorTest {
 
 	@Test
 	public void validationFails_when_TokenAudiencesAreEmpty() {
-		Mockito.when(token.getAudiences()).thenReturn(Collections.emptyList());
+		Mockito.when(token.getAudiences()).thenReturn(Collections.emptySet());
 
 		ValidationResult result = new JwtAudienceValidator("any")
 				.validate(token);
diff --git a/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtSignatureValidatorTest.java b/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtSignatureValidatorTest.java
index 9b898f66..3e327783 100644
--- a/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtSignatureValidatorTest.java
+++ b/java-security/src/test/java/com/sap/cloud/security/token/validation/validators/JwtSignatureValidatorTest.java
@@ -203,12 +203,6 @@ public class JwtSignatureValidatorTest {
 	@Test
 	@Ignore
 	public void jsonECSignatureMatchesJWKS() {
-		/*{
-			"kty": "EC",
-				"kid": "key-id-1",
-				"alg": "ES256",
-				"value": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQgb5npLHd0Bk61bNnjK632uwmBfr\nF7I8hoPgaOZjyhh+BrPDO6CL6D/aW/yPObXXm7SpZogmRwGROcOA3yUleg==\n-----END PUBLIC KEY-----"
-		}*/
 		String ecSignedToken = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.4iVk3-Y0v4RT4_9IaQlp-8dZ_4fsTzIylgrPTDLrEvTHBTyVS3tgPbr2_IZfLETtiKRqCg0aQ5sh9eIsTTwB1g";
 		assertThat(cut.validate(ecSignedToken, "ES256", "key-id-1", null, null).isValid(), is(true));
 	}
diff --git a/java-security/src/test/resources/jsonWebTokenKeys.json b/java-security/src/test/resources/jsonWebTokenKeys.json
index aecfd47f..a6276af1 100644
--- a/java-security/src/test/resources/jsonWebTokenKeys.json
+++ b/java-security/src/test/resources/jsonWebTokenKeys.json
@@ -17,6 +17,12 @@
       "value": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmNM3OXfZS0Uu8eYZXCgG\nWFgVWQX6MHnadYk3zHZ5PIPeDY3ApaSGpMEiVwn1cT6KUVHMLHcmz1gsNy74pCnm\nCa22W7J3BoZulzR0A37ayMVrRHh3nffgySk8u581l02bvbcpab3e3EotSN5LixGT\n1VWZvDbalXf6n5kq459NWL6ZzkEs20MrOEk5cLdnsigTQUHSKIQ5TpldyDkJMm2z\nwOlrB2R984+QdlDFmoVH7Yaujxr2g0Z96u7W9Imik6wTiFc8W7eUXfhPGn7reVLq\n1/5o2Nz0Jx0ejFHDwTGncs+k1RBS6DbpTOMr9tkJEc3ZsX3Ft4OtqCkRXI5hUma+\nHwIDAQAB\n-----END PUBLIC KEY-----",
       "n": "AJjTNzl32UtFLvHmGVwoBlhYFVkF-jB52nWJN8x2eTyD3g2NwKWkhqTBIlcJ9XE-ilFRzCx3Js9YLDcu-KQp5gmttluydwaGbpc0dAN-2sjFa0R4d5334MkpPLufNZdNm723KWm93txKLUjeS4sRk9VVmbw22pV3-p-ZKuOfTVi-mc5BLNtDKzhJOXC3Z7IoE0FB0iiEOU6ZXcg5CTJts8DpawdkffOPkHZQxZqFR-2Gro8a9oNGferu1vSJopOsE4hXPFu3lF34Txp-63lS6tf-aNjc9CcdHoxRw8Exp3LPpNUQUug26UzjK_bZCRHN2bF9xbeDragpEVyOYVJmvh8"
     },
+    {
+      "kty": "EC",
+      "kid": "key-id-1",
+      "alg": "ES256",
+      "value": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQgb5npLHd0Bk61bNnjK632uwmBfr\nF7I8hoPgaOZjyhh+BrPDO6CL6D/aW/yPObXXm7SpZogmRwGROcOA3yUleg==\n-----END PUBLIC KEY-----"
+    },
     {
       "kty": "RSA",
       "e": "AQAB",
diff --git a/token-client/src/test/java/com/sap/cloud/security/xsuaa/jwk/JsonWebKeySetTest.java b/token-client/src/test/java/com/sap/cloud/security/xsuaa/jwk/JsonWebKeySetTest.java
index 09c48d2b..6b36c8bc 100644
--- a/token-client/src/test/java/com/sap/cloud/security/xsuaa/jwk/JsonWebKeySetTest.java
+++ b/token-client/src/test/java/com/sap/cloud/security/xsuaa/jwk/JsonWebKeySetTest.java
@@ -3,7 +3,6 @@ package com.sap.cloud.security.xsuaa.jwk;
 import com.sap.cloud.security.xsuaa.jwt.JwtSignatureAlgorithm;
 import com.sap.cloud.security.xsuaa.util.JsonWebKeyTestFactory;
 import org.junit.Before;
-import org.junit.Ignore;
 import org.junit.Test;
 
 import static com.sap.cloud.security.xsuaa.jwk.JsonWebKey.*;
@@ -34,9 +33,8 @@ public class JsonWebKeySetTest {
 	}
 
 	@Test
-	@Ignore
 	public void getKeyByAlgorithmAndId_returnsNull_whenKeyTypeDoesNotMatch() {
-		JwtSignatureAlgorithm differentKeyAlgorithm = JwtSignatureAlgorithm.RS256; //ES256
+		JwtSignatureAlgorithm differentKeyAlgorithm = JwtSignatureAlgorithm.ES256;
 
 		cut.put(JSON_WEB_KEY);