[JIRA] (JCOMOIDC-45) Add a Decrypter for JWE tokens similar to the opensaml Decrypter

[Philip Smart (Jira)]

Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 ) *commented* on JCOMOIDC-45 ( https://shibboleth.atlassian.net/browse/JCOMOIDC-45?atlOrigin=eyJpIjoiODMyYzkyZDBkY2MxNGJlNWJkNjY0YjQwYTc4NTNlZDUiLCJwIjoiaiJ9 )

Re: Add a Decrypter for JWE tokens similar to the opensaml Decrypter ( https://shibboleth.atlassian.net/browse/JCOMOIDC-45?atlOrigin=eyJpIjoiODMyYzkyZDBkY2MxNGJlNWJkNjY0YjQwYTc4NTNlZDUiLCJwIjoiaiJ9 )

I've changed over the StaticJOSEObjectCredentialResolver to be a CollectionJOSEObjectCredentialResolver as it is filterable based on the EvaluableCredentialCriterion , which is more inline with the CollectionCredentialResolver.

I've added a LocalJOSEObjectCredentialResolver which extends the BasicJOSEObjectCredentialResolver and hence AbstractCriteriaFilteringCredentialResolver. For now it just calls the local collection credential resolver mentioned above. It currently filters credentials based on usual algorithm parameters and 'kid' if one exists (built as criteria in the JWTDecrypter class). I now need to optionally resolve and filter private keys based on any corresponding public keys found by the BasicJOSEObjectCredentialResolver in the JOSE header ('jwk' or fetched from 'jku'). It is possible that only the 'kid' is defined, so we must also resolve those local credentials without having a corresponding public key to match.

Of note, for encryption, we (the OIDC OP and RP) do not seem to support adding the public key to the JOSE header, only the ‘kid’, maybe we should. I added in a ticket in case it will be useful at some point https://shibboleth.atlassian.net/browse/JOIDC-122

( https://shibboleth.atlassian.net/browse/JCOMOIDC-45#add-comment?atlOrigin=eyJpIjoiODMyYzkyZDBkY2MxNGJlNWJkNjY0YjQwYTc4NTNlZDUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JCOMOIDC-45#add-comment?atlOrigin=eyJpIjoiODMyYzkyZDBkY2MxNGJlNWJkNjY0YjQwYTc4NTNlZDUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100204- sha1:d476756 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220804/39390a29/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-ce736e0b-c5e8-4229-ac0e-14221fb207ee
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220804/39390a29/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-f59794dc-943f-4767-9950-0f8e36886cae
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220804/39390a29/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-c65ef545-bf98-4621-80cf-bf1c6d22d802
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220804/39390a29/attachment-0005.png>