[java-idp-plugin-oidc-rp] branch main updated: Add back key agreement support. This is untestable.

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=04a149309f72bb75d5020b709e2d7629d5975653

The following commit(s) were added to refs/heads/main by this push:
     new 04a1493  Add back key agreement support. This is untestable.
04a1493 is described below

commit 04a149309f72bb75d5020b709e2d7629d5975653
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Aug 2 16:47:49 2022 +0100

    Add back key agreement support. This is untestable.
---
 .../ProviderMetadataEncryptionParametersResolver.java | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java
index 23a5cb5..d8a1df0 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java
@@ -40,6 +40,7 @@ import com.nimbusds.jose.Algorithm;
 import com.nimbusds.jose.EncryptionMethod;
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.jwk.ECKey;
 import com.nimbusds.jose.jwk.JWK;
 import com.nimbusds.jose.jwk.JWKSet;
 import com.nimbusds.jose.jwk.KeyType;
@@ -194,7 +195,8 @@ public class ProviderMetadataEncryptionParametersResolver extends BasicEncryptio
         
         final List<String> supportedAndConfiguredKeyTransportAlgorithms = 
                 findAlgorithmIntersection(keyTransportAlgorithms.stream().map(JWEAlgorithm::getName)
-                        .collect(Collectors.toList()),keyTransportAlgorithmSupported);
+                        .collect(Collectors.toList()),keyTransportAlgorithms.stream().map(JWEAlgorithm::getName)
+                        .collect(Collectors.toList()));
         
         final List<String> supportedAndConfiguredDataEncryptionAlgorithms = 
                 findAlgorithmIntersection(dataEncryptionMethods.stream().map(EncryptionMethod::getName)
@@ -237,12 +239,9 @@ public class ProviderMetadataEncryptionParametersResolver extends BasicEncryptio
         }
         
         // Find and process key encryption mode
-        resolveKeyEncryptionCredential(getProviderKeys(metadata), supportedJWEKeyTransportAlgorithms, 
+        resolveKeyEncryptionAndAgreementCredential(getProviderKeys(metadata), supportedJWEKeyTransportAlgorithms, 
                 params, encryptionMethod);
-        
-        // TODO Key agreement?    
-        
-        
+
         if (params.getKeyTransportEncryptionCredential() == null) {
             log.debug("Not able to locate encryption credentials based on provider metadata or encryption "
                     + "configuration");
@@ -253,7 +252,7 @@ public class ProviderMetadataEncryptionParametersResolver extends BasicEncryptio
     }
     
     /**
-     * Resolve a suitable key encryption credential from those fetched from the OP's remote key set.
+     * Resolve a suitable key encryption or key agreement credential from those fetched from the OP's remote key set.
      * The first compatible key and algorithm are chosen. 
      * 
      * @param keySet the providers keyset
@@ -261,7 +260,7 @@ public class ProviderMetadataEncryptionParametersResolver extends BasicEncryptio
      * @param params the encryption parameters to add the credential to
      * @param encryptionMethod the encryption method to use
      */
-    private void resolveKeyEncryptionCredential(final JWKSet keySet, 
+    private void resolveKeyEncryptionAndAgreementCredential(final JWKSet keySet, 
             final List<JWEAlgorithm> keyTransportAlgorithms,
             final EncryptionParameters params, final EncryptionMethod encryptionMethod) {
         
@@ -284,7 +283,9 @@ public class ProviderMetadataEncryptionParametersResolver extends BasicEncryptio
                     try {
                         if (key.getKeyType().equals(KeyType.RSA)) {
                             jwkCredential.setPublicKey(((RSAKey) key).toPublicKey());
-                        } 
+                        } else if (key.getKeyType().equals(KeyType.EC)){
+                            jwkCredential.setPublicKey(((ECKey) key).toPublicKey());
+                        }
                     } catch (final JOSEException e) {
                         log.warn("Unable to parse keyset", e);
                         continue;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.