[JIRA] (JCOMOIDC-45) Add a Decrypter for JWE tokens similar to the opensaml Decrypter

[Brent Putman (Jira)]

Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) *commented* on JCOMOIDC-45 ( https://shibboleth.atlassian.net/browse/JCOMOIDC-45?atlOrigin=eyJpIjoiYmE0MDI2N2MyNTAxNDk1M2JmMjVjZTZjM2RmNTc2YzQiLCJwIjoiaiJ9 )

Re: Add a Decrypter for JWE tokens similar to the opensaml Decrypter ( https://shibboleth.atlassian.net/browse/JCOMOIDC-45?atlOrigin=eyJpIjoiYmE0MDI2N2MyNTAxNDk1M2JmMjVjZTZjM2RmNTc2YzQiLCJwIjoiaiJ9 )

And a separate but related thing comes to mind…

Whether you accept my suggestion or not, the resolution of the “local” cred should filter out things that don’t make sense. For example key algorithms and key lengths should match. E.g. don’t return an RSA key when it’s an EC case.

So I think more criteria should be added to the criteria set. See the XML Decrypter in xmlsec-impl (not saml-impl), there’s a method there that builds some criteria like that.

It may not be obvious, but the eval of that criteria input is done auto-magically by one of the abstract base classes of resolver called AbstractCriteriaFilteringCredentialResolver. When possible it dynamically adds an EvaluableCredentialCriterion based on each non-evaluable criteria, resolved from a registry. It then filters the collection based on that.

I don’t know which impl you are planning on use for the “local” cred resolvers here, but if it’s an OIDC-specific one that doesn’t extend that, it probably should. Unfortunately it’s currently in an OpenSAML impl module, so we’d have to think about promoting that to API. Or else just copy it. I actually already have a TODO in the BasicJOSEObjectCredentialResolver about that (which is not a “local” cred resolver, but still is something it maybe should support).

( https://shibboleth.atlassian.net/browse/JCOMOIDC-45#add-comment?atlOrigin=eyJpIjoiYmE0MDI2N2MyNTAxNDk1M2JmMjVjZTZjM2RmNTc2YzQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JCOMOIDC-45#add-comment?atlOrigin=eyJpIjoiYmE0MDI2N2MyNTAxNDk1M2JmMjVjZTZjM2RmNTc2YzQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100202- sha1:e905ae5 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220714/c43fa13a/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-4a48b277-649b-4c93-b02b-d9aaf8e8a9da
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220714/c43fa13a/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-d3e6e114-4951-4d68-a635-ab5873bc326a
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220714/c43fa13a/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-2038111a-1115-4da8-94aa-c8bdf498131b
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220714/c43fa13a/attachment-0005.png>