[JIRA] (JOIDCRP-17) Add JWT Encryption Parameter Resolver Support

[Philip Smart (Jira)]

Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 ) *commented* on JOIDCRP-17 ( https://shibboleth.atlassian.net/browse/JOIDCRP-17?atlOrigin=eyJpIjoiOTJmY2I4ZWI3Mzg3NGY3YWFjM2FiYzc5NTliZDIwNmMiLCJwIjoiaiJ9 )

Re: Add JWT Encryption Parameter Resolver Support ( https://shibboleth.atlassian.net/browse/JOIDCRP-17?atlOrigin=eyJpIjoiOTJmY2I4ZWI3Mzg3NGY3YWFjM2FiYzc5NTliZDIwNmMiLCJwIjoiaiJ9 )

I’ve improved the ProviderMetadataEncryptionParametersResolver. Credentials are resolved as follows (this logic needs reviewing):

* Get the effective key transport algorithms from the config, and check they are compatible with those registered by the OpenID Provider and include/excludes list. Remove any that are not, but preserve the order they are specified in the config.
* Get the effective data encryption algorithms from the config, and check they are compatible with those registered by the OpenID Provider and include/excludes list. Remove any that are not, but preserve the order they are specified in the config.
* Loop through the key transport algorithms * return any credential, either locally configured (e.g. for key wrap) or from the providers keyset (fetched from the jwk_uri) that matches the algorithm and key usage.

* Return the encryption parameters for later use by the Nimbus encrypters - which themselves will check key compatibility with the chosen key managment mode.

This does not support ‘dir’ Direct Encryption and ECDH is still proving tricky to test properly (see below comment)

( https://shibboleth.atlassian.net/browse/JOIDCRP-17#add-comment?atlOrigin=eyJpIjoiOTJmY2I4ZWI3Mzg3NGY3YWFjM2FiYzc5NTliZDIwNmMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDCRP-17#add-comment?atlOrigin=eyJpIjoiOTJmY2I4ZWI3Mzg3NGY3YWFjM2FiYzc5NTliZDIwNmMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100204- sha1:d476756 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220804/d38ceac5/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-70beb239-a488-42fd-87df-784c330d52ed
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220804/d38ceac5/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-7d088892-032d-4f63-b61c-8332b5f4959b
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220804/d38ceac5/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-1b38fb7d-f9f8-4013-b56c-df20c9c3bdbb
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220804/d38ceac5/attachment-0005.png>