[java-idp-plugin-oidc-rp] branch main updated: Switch singing parameter lookup to use algorithm priority

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=24507520f8afc6143a585939bcaa6bf948fe15da

The following commit(s) were added to refs/heads/main by this push:
     new 2450752  Switch singing parameter lookup to use algorithm priority
2450752 is described below

commit 24507520f8afc6143a585939bcaa6bf948fe15da
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Dec 19 16:02:45 2022 +0000

    Switch singing parameter lookup to use algorithm priority
    
    Like the encryption resolvers
---
 ...RelyingPartyProxySigningParametersResolver.java | 59 +++++++++++-----------
 1 file changed, 29 insertions(+), 30 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
index e4ed289..16b9eef 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
@@ -121,22 +121,23 @@ public class RelyingPartyProxySigningParametersResolver extends BasicJWTSignatur
         final List<JWSAlgorithm> supportedAlgorithms = convertSupportAlgorithmsToJwkAlgorithms(filteredAlgorithms);
         log.trace("Resolved effective signature algorithms: {}", supportedAlgorithms);
         
-        // Pick the first credential that matches one of the supported algorithms
-        for (final Credential credential : allCredentials) {   
-            if (log.isTraceEnabled()) {
-                log.trace("Evaluating signing credential '{}'", CredentialConversionUtil.resolveKid(credential));
-            }
-            final JWSAlgorithm foundSupportedAlgorithm = 
-                    credentialSupportsSigningAlgorithm(credential, supportedAlgorithms);
-            if (foundSupportedAlgorithm != null) {    
-                log.trace("Credential supports algorithm '{}'", foundSupportedAlgorithm);
-                params.setSigningCredential(credential);
-                params.setSignatureAlgorithm(foundSupportedAlgorithm.getName());
-                return;
+        // Pick the first credential that matches one of the supported algorithms. Take algorithm priority.
+        for (final JWSAlgorithm algorithm : supportedAlgorithms) {
+            for (final Credential credential : allCredentials) {
+                if (log.isTraceEnabled()) {
+                    log.trace("Evaluating signing credential '{}'", CredentialConversionUtil.resolveKid(credential));
+                }
+                final JWSAlgorithm foundSupportedAlgorithm = 
+                        credentialSupportsSigningAlgorithm(credential, algorithm);
+                if (foundSupportedAlgorithm != null) {    
+                    log.trace("Credential supports algorithm '{}'", foundSupportedAlgorithm);
+                    params.setSigningCredential(credential);
+                    params.setSignatureAlgorithm(foundSupportedAlgorithm.getName());
+                    return;
+                }
+                log.trace("Credential failed eval against Signing Algorithm");
             }
-            log.trace("Credential failed eval against Signing Algorithm");
-            
-        }
+        }        
     }  
 
     /**
@@ -151,7 +152,7 @@ public class RelyingPartyProxySigningParametersResolver extends BasicJWTSignatur
     }
 
     /**
-     * Check the credential supports one of the supported algorithms input. If it does, the algorithm it supports
+     * Check the credential supports the algorithm input. If it does, the algorithm it supports
      * is returned. If none are supported, {@literal null} is returned.
      * 
      * @param credential the credential to test
@@ -160,22 +161,20 @@ public class RelyingPartyProxySigningParametersResolver extends BasicJWTSignatur
      * @return the supported algorithm, or {@literal null} if none are supported
      */
     @Nullable private JWSAlgorithm credentialSupportsSigningAlgorithm(@Nonnull final Credential credential, 
-            @Nonnull final List<JWSAlgorithm> supportedAlgorithms) {
-    
-        for (final JWSAlgorithm algorithm : supportedAlgorithms) {
+            @Nonnull final JWSAlgorithm supportedAlgorithm) {
             
-            if (JWSAlgorithm.Family.HMAC_SHA.contains(algorithm) && credential.getSecretKey() != null ||
-                  (JWSAlgorithm.Family.RSA.contains(algorithm) && 
-                    credential.getPrivateKey() instanceof RSAPrivateKey) ||
-                  (JWSAlgorithm.Family.EC.contains(algorithm)
-                    && credential.getPrivateKey() instanceof ECPrivateKey
-                    && curveMatchesESAlgorithm(Curve.forECParameterSpec(
-                                    ((java.security.interfaces.ECKey) credential.getPrivateKey()).getParams()),
-                            algorithm))) {
-                return algorithm;
-            } 
-        }
+        if (JWSAlgorithm.Family.HMAC_SHA.contains(supportedAlgorithm) && credential.getSecretKey() != null ||
+              (JWSAlgorithm.Family.RSA.contains(supportedAlgorithm) && 
+                credential.getPrivateKey() instanceof RSAPrivateKey) ||
+              (JWSAlgorithm.Family.EC.contains(supportedAlgorithm)
+                && credential.getPrivateKey() instanceof ECPrivateKey
+                && curveMatchesESAlgorithm(Curve.forECParameterSpec(
+                                ((java.security.interfaces.ECKey) credential.getPrivateKey()).getParams()),
+                        supportedAlgorithm))) {
+            return supportedAlgorithm;
+        }  
         return null;
+
     }
     
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.