FR: jwt validate

[lesv]

We should have some functionality to verify JWT's.

1. General validation of jwt

2. Validation of a Google JWT
   (Get and cache Google's certificates - validate: iss, iat?, & exp)

3. Validation of a Firebase JWT
   (get and cache Firebase certificates, validate: iss, iat, & exp)

4. Validate Identity provider tokens as well. (FB, Twitter, Github, etc.)

See https://github.com/auth0/java-jwt

[lesv]

This should guide us:
https://github.com/GoogleCloudPlatform/google-auth-library-python/pull/7/files
https://github.com/GoogleCloudPlatform/google-auth-library-python/pull/82/files

[lesv]

@anthmgoogle @garrettjonesgoogle It may be a few weeks, but I need to do this for one of my projects, once that's done, I'd like to contribute it here.

Any suggestions or comments?

[lesv]

They seem to have a java library, once I've written code against it, I'll close this.

[jabubake]

+1 , IAP samples use Nimbus-JOSE-JWT.
It provides an easy way to load the public JWKs
Auth0 library has intermitten verification issues on OpenJDK
jjwt : requires a lot of boiler plate code and additional libraries (boucycastle) to deal with JWKs

We require google-auth-library-java to load the service account credentials to sign the JWT : so it is a painful user experience to not support JWT generation / verification.