[JIRA] (JCOMOIDC-41) Move OIDC Signature Validation resolvers and parameter classes to commons

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JCOMOIDC-41 ( https://shibboleth.atlassian.net/browse/JCOMOIDC-41?atlOrigin=eyJpIjoiOTI3MTViNjUwNTlkNGVhNWFhOGU0MzA3OGI0Yjg0OTkiLCJwIjoiaiJ9 )

Re: Move OIDC Signature Validation resolvers and parameter classes to commons ( https://shibboleth.atlassian.net/browse/JCOMOIDC-41?atlOrigin=eyJpIjoiOTI3MTViNjUwNTlkNGVhNWFhOGU0MzA3OGI0Yjg0OTkiLCJwIjoiaiJ9 )

The root interface on the XML side is org.opensaml.xmlsec.signature.support.SignatureTrustEngine, which is TrustEngine<Signature>. What we need (I think) is TrustEngine<SignedJWT> because the signature doesn’t really stand alone in our use cases (I think Jose might allow for detached, but it’s probably much messier to try to generalize all this for no good reason).

I suspect that duplicating rather than trying to achieve any reuse of the base classes that implement this interface is probably what we have to go for. org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine<TrustBasisType> and the ExplicitKey subclass of that are the two classes we need to emulate, along with the various supporting bits, to make this work.

Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) If you want to see the raw logic that implements signature validation now, it’s all inside net.shibboleth.oidc.security.impl.JWTSignatureValidationUtil (and that class probably shouldn’t even be in impl, since it’s critical for the moment to use in the OIDC plugins. Eventually though it’s the class we need to replace with a new ExplicitKeyTrustEngine that implements SignatureTrustEngine<SignedJWT>.

( https://shibboleth.atlassian.net/browse/JCOMOIDC-41#add-comment?atlOrigin=eyJpIjoiOTI3MTViNjUwNTlkNGVhNWFhOGU0MzA3OGI0Yjg0OTkiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JCOMOIDC-41#add-comment?atlOrigin=eyJpIjoiOTI3MTViNjUwNTlkNGVhNWFhOGU0MzA3OGI0Yjg0OTkiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100191- sha1:7bb8b76 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220204/5997f69c/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-93f37dc2-88a5-4612-944c-1b4a249cdf02
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220204/5997f69c/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-d7881a06-b20b-4259-beb0-15949bf3dd6a
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220204/5997f69c/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-d32dba3f-05db-4cfc-8aa9-b8a12bca86d0
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220204/5997f69c/attachment-0005.png>