[JIRA] (JOIDC-136) Configuration options for OIDC signature validation

[Simone Avogadro (Jira)]

Simone Avogadro ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A60a84ee1-4961-471b-99d8-f67c05e24403 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiOWY5MjBiOWRmN2Q4NDc1OGI5MDQ3NGMzNTczNGM1ZGUiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/JOIDC-136?atlOrigin=eyJpIjoiOWY5MjBiOWRmN2Q4NDc1OGI5MDQ3NGMzNTczNGM1ZGUiLCJwIjoiaiJ9 ) JOIDC-136 ( https://shibboleth.atlassian.net/browse/JOIDC-136?atlOrigin=eyJpIjoiOWY5MjBiOWRmN2Q4NDc1OGI5MDQ3NGMzNTczNGM1ZGUiLCJwIjoiaiJ9 ) Configuration options for OIDC signature validation ( https://shibboleth.atlassian.net/browse/JOIDC-136?atlOrigin=eyJpIjoiOWY5MjBiOWRmN2Q4NDc1OGI5MDQ3NGMzNTczNGM1ZGUiLCJwIjoiaiJ9 )

Issue Type: Improvement Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Components: Security Created: 23/Nov/22 3:59 AM Priority: Trivial Reporter: Simone Avogadro ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A60a84ee1-4961-471b-99d8-f67c05e24403 )

Looking into:

idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml

at lines 690/693 I can see that the property idp.oidc.rovalid.config defines both the signature validation algorithms for request object and token endpoint jwt validation, which however by default use separate beans:

<property name= "requestObjectSignatureValidationConfiguration" >
   <ref bean= "#{ '%{idp.oidc.rovalid.config:shibboleth.oidc.requestObjectSignatureValidationConfiguration}'.trim()}" />
</property>
<property name= "tokenEndpointJwtSignatureValidationConfiguration" >
   <ref bean= "#{ '%{idp.oidc.rovalid.config:shibboleth.oidc.tokenEndpointJwtSignatureValidationConfiguration}'.trim()}" />
</property>

I’m unsure if this is mandated by specs or just slipped in. Currently the two default beans define the very same list so maybe it makes sense to unify them. Furthermore if a deployer does not trust an algorithm they will probably want to remove them from anywhere

CC Massimiliano Mauri ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Aea2f947e-4c48-4fb2-94c2-1de675d1400f )

( https://shibboleth.atlassian.net/browse/JOIDC-136#add-comment?atlOrigin=eyJpIjoiOWY5MjBiOWRmN2Q4NDc1OGI5MDQ3NGMzNTczNGM1ZGUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-136#add-comment?atlOrigin=eyJpIjoiOWY5MjBiOWRmN2Q4NDc1OGI5MDQ3NGMzNTczNGM1ZGUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:eab5823 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221123/cce33f57/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-1a8627b3-55ca-47f5-a9a2-31bb9a0a1f93
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221123/cce33f57/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-d69cc77a-8e0c-4ef8-871f-1a4b80b03c01
Type: image/png
Size: 448 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221123/cce33f57/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-218506fa-c562-4c5d-94f8-3ad5c944850b
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221123/cce33f57/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-00d96140-980c-4fb8-adca-58732a3bb48b
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221123/cce33f57/attachment-0007.png>