[JIRA] (JOIDC-108) Documentation: functions to sign/encrypt/decrypt JWTs

[Simone Avogadro (Jira)]

Simone Avogadro ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A60a84ee1-4961-471b-99d8-f67c05e24403 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiY2EyNDQzM2JjZTEwNDM1MmE2ODU0Yzg1MzIxM2ZjNjQiLCJwIjoiaiJ9 ) / New Feature ( https://shibboleth.atlassian.net/browse/JOIDC-108?atlOrigin=eyJpIjoiY2EyNDQzM2JjZTEwNDM1MmE2ODU0Yzg1MzIxM2ZjNjQiLCJwIjoiaiJ9 ) JOIDC-108 ( https://shibboleth.atlassian.net/browse/JOIDC-108?atlOrigin=eyJpIjoiY2EyNDQzM2JjZTEwNDM1MmE2ODU0Yzg1MzIxM2ZjNjQiLCJwIjoiaiJ9 ) Documentation: functions to sign/encrypt/decrypt JWTs ( https://shibboleth.atlassian.net/browse/JOIDC-108?atlOrigin=eyJpIjoiY2EyNDQzM2JjZTEwNDM1MmE2ODU0Yzg1MzIxM2ZjNjQiLCJwIjoiaiJ9 )

Issue Type: New Feature Affects Versions: 3.1.2 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Components: Foundation Created: 24/May/22 3:21 AM Priority: Trivial Reporter: Simone Avogadro ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A60a84ee1-4961-471b-99d8-f67c05e24403 )

That’s a request for documentation/hints rather then a request for a feature.

Building the functions described below is surely already possible but would be a duplication of the OP’s logics and thus would not benefit from OP evolution etc…

When writing extensions there are some secuirty-critical tasks which will be repeated in various places and which need to tap into existing Shibboleth OP’s machinery. Most probably the OP/Commons already has an entry point into that. It’d be useful to have that documented for “advanced deployers”.

The three key functions we’d need today are:

* verify JWT signature, taking into account RP’s metadata, exp, iat, etc…

* input: signed JWT, client_id
* output: true/false or otherwise void/exception

* sign JWT for a client, taking into account RP’s metadata

* input: JWT, client_id
* output: signed JWT

* encrypt JWT to for a client, taking into account the OP’s keys and the RP’s metadata, basically we’d need somethign which

* input: JWT (which might be signed), client_id
* output: encrypted JWT

( https://shibboleth.atlassian.net/browse/JOIDC-108#add-comment?atlOrigin=eyJpIjoiY2EyNDQzM2JjZTEwNDM1MmE2ODU0Yzg1MzIxM2ZjNjQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-108#add-comment?atlOrigin=eyJpIjoiY2EyNDQzM2JjZTEwNDM1MmE2ODU0Yzg1MzIxM2ZjNjQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:faaaa62 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220524/1340ff44/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-7480ffe1-a2cd-444a-bb28-45a9401839b8
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220524/1340ff44/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-fa55b522-5f10-4395-8529-af972d279301
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220524/1340ff44/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-02ffc61a-da33-400e-9065-c52f8a7926b8
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220524/1340ff44/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-ff221eef-1669-4a76-b34f-8fdf7913cc08
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220524/1340ff44/attachment-0007.png>