[java-oidc-common] 21/35: Improve encryption credential resolution
Phil Smart
philip.smart at jisc.ac.uk
Tue Sep 20 14:19:21 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=ce6b93d97cafecf04795be90205f8fb48fe666f3
commit ce6b93d97cafecf04795be90205f8fb48fe666f3
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Aug 4 15:51:38 2022 +0100
Improve encryption credential resolution
Harmonize collection based JOSE Object credential resolver
Adjust local JOSE credential resolver
Minor improvments for encryption
---
.../impl/BasicJOSEObjectCredentialResolver.java | 22 ++++--
.../CollectionJOSEObjectCredentialResolver.java | 84 ++++++++++++++++++++++
.../impl/LocalJOSEObjectCredentialResolver.java | 55 ++++++++++----
.../impl/StaticJOSEObjectCredentialResolver.java | 50 -------------
.../impl/BasicJWKCredentialFactoryBean.java | 21 +++++-
.../oidc/security/impl/JWTDecrypter.java | 2 +-
6 files changed, 165 insertions(+), 69 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
index f9a13d9..b4d4d76 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.credential.impl;
import java.util.ArrayList;
@@ -29,13 +46,10 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
- * A basic implementation of {@link JOSEObjectCredentialResolver}.
- *
+ * A basic implementation of {@link JOSEObjectCredentialResolver}. *
*/
public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
implements JOSEObjectCredentialResolver {
- // TODO AbstractCriteriaFilteringCredentialResolver It's impl, so would have to copy or refactor to
- // common library or promote to API.
/** Logger. */
private final Logger log = LoggerFactory.getLogger(BasicJOSEObjectCredentialResolver.class);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java
new file mode 100644
index 0000000..b45b01a
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential.impl;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.security.credential.Credential;
+
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ *
+ * An implementation of {@link BasicJOSEObjectCredentialResolver} that
+ * uses a {@link Collection} as the underlying credential source.
+ *
+ *
+ * <p>
+ * Like the
+ * {@link BasicJOSEObjectCredentialResolver}, credentials returned are filtered based on any
+ * {@link org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion}
+ * which may have been present in the specified criteria set, or which are resolved by lookup in the
+ * {@link org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry}.
+ * </p>
+ */
+public class CollectionJOSEObjectCredentialResolver extends BasicJOSEObjectCredentialResolver {
+
+ /** List of credentials held by this resolver. */
+ private final List<Credential> collection;
+
+ /**
+ * Constructor.
+ *
+ * @param credentials collection of credentials to be held by this resolver
+ */
+ public CollectionJOSEObjectCredentialResolver(
+ @Nonnull @ParameterName(name="credentials") final List<Credential> credentials) {
+ Constraint.isNotNull(credentials, "Input credentials list cannot be null");
+
+ collection = new ArrayList<>(credentials);
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param credential a single credential to be held by this resolver
+ */
+ public CollectionJOSEObjectCredentialResolver(
+ @Nonnull @ParameterName(name="credential") final Credential credential) {
+ Constraint.isNotNull(credential, "Input credential cannot be null");
+
+ collection = new ArrayList<>();
+ collection.add(credential);
+ }
+
+ @Override
+ @Nonnull public Iterable<Credential> resolveFromSource(
+ @Nullable final CriteriaSet criteria) throws ResolverException {
+ return collection;
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
index a2cdd45..f24bc2f 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.credential.impl;
import javax.annotation.Nonnull;
@@ -5,7 +22,8 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.CredentialResolver;
-import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
@@ -15,34 +33,45 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
* A simple specialization of {@link BasicJOSEObjectCredentialResolver}
- * which is capable of using information from a {@link org.opensaml.xmlsec.signature.KeyInfo} to resolve
- * local credentials from a supplied {@link CredentialResolver} which manages local credentials.
- *
- * TODO: Finish
+ * which is capable of using resolving local credentials from a supplied {@link CredentialResolver}
+ * which manages local credentials.
*/
+// TODO use the 'public' credentials on the JOSE Object headers to locate local private keys with in addition to
+// those located by 'kid'
public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredentialResolver {
+ /** Class logger. */
+ private final Logger log = LoggerFactory.getLogger(LocalJOSEObjectCredentialResolver.class);
+
/** The resolver which is used to resolve local credentials. */
private final JOSEObjectCredentialResolver localCredResolver;
/**
* Constructor.
- *
- * @param keyInfoProviders the list of {@link KeyInfoProvider}s to use in this resolver
+ *
* @param localCredentialResolver resolver of local credentials
*/
public LocalJOSEObjectCredentialResolver(@Nonnull
- @ParameterName(name="localCredentialResolver") final JOSEObjectCredentialResolver localCredentialResolver) {
-
+ @ParameterName(name="localCredentialResolver") final JOSEObjectCredentialResolver localCredentialResolver) {
localCredResolver = Constraint.isNotNull(localCredentialResolver, "Local credential resolver cannot be null");
}
+ /**
+ * Get the resolver for local credentials.
+ *
+ * The credentials managed and returned by this resolver should all contain
+ * either a secret (symmetric) or private key.
+ *
+ * @return resolver of local credentials
+ */
+ @Nonnull public CredentialResolver getLocalCredentialResolver() {
+ return localCredResolver;
+ }
+
@Override
@Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
- throws ResolverException {
-
- return localCredResolver.resolve(criteriaSet);
-
+ throws ResolverException {
+ return getLocalCredentialResolver().resolve(criteriaSet);
}
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/StaticJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/StaticJOSEObjectCredentialResolver.java
deleted file mode 100644
index 8e42170..0000000
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/StaticJOSEObjectCredentialResolver.java
+++ /dev/null
@@ -1,50 +0,0 @@
-package net.shibboleth.oidc.security.credential.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-//TODO finish. This should be a local one? This is temporary until it is all figured out
-public class StaticJOSEObjectCredentialResolver extends BasicJOSEObjectCredentialResolver {
-
- /** List of credentials held by this resolver. */
- private final List<Credential> creds;
-
- /**
- * Constructor.
- *
- * @param credentials collection of credentials to be held by this resolver
- */
- public StaticJOSEObjectCredentialResolver(@Nonnull @ParameterName(name="credentials") final List<Credential> credentials) {
- Constraint.isNotNull(credentials, "Input credentials list cannot be null");
-
- creds = new ArrayList<>(credentials);
- }
-
- /**
- * Constructor.
- *
- * @param credential a single credential to be held by this resolver
- */
- public StaticJOSEObjectCredentialResolver(@Nonnull @ParameterName(name="credential") final Credential credential) {
- Constraint.isNotNull(credential, "Input credential cannot be null");
-
- creds = new ArrayList<>();
- creds.add(credential);
- }
-
- @Override
- @Nonnull public Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteria) throws ResolverException {
- return creds;
- }
-
-}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWKCredentialFactoryBean.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWKCredentialFactoryBean.java
index 569f26f..2389df9 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWKCredentialFactoryBean.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWKCredentialFactoryBean.java
@@ -39,6 +39,8 @@ import com.nimbusds.jose.jwk.OctetSequenceKey;
import net.shibboleth.idp.profile.spring.factory.AbstractCredentialFactoryBean;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
/** factory bean for Basic JSON Web Keys (JWK). */
public class BasicJWKCredentialFactoryBean extends AbstractCredentialFactoryBean<BasicJWKCredential> {
@@ -52,9 +54,26 @@ public class BasicJWKCredentialFactoryBean extends AbstractCredentialFactoryBean
/** Should the factory throw an exception if the resource is null?.*/
private boolean failIfResourceIsNull;
+ /**
+ * The JCA algorithm name to use if the key to be converted is a symmetric key.
+ * Default is AES.
+ */
+ private String symmetricKeyAlgorithm;
+
/** Constructor.*/
public BasicJWKCredentialFactoryBean() {
failIfResourceIsNull = true;
+ symmetricKeyAlgorithm = "AES";
+ }
+
+ /**
+ * Set the JCA algorithm name to use if the key to be converted is a symmetric key.
+ *
+ * @param algorithm the JCA name
+ */
+ public void setSymmetricKeyAlgorithm(@Nonnull @NotEmpty final String algorithm) {
+ symmetricKeyAlgorithm =
+ Constraint.isNotEmpty(algorithm, "SymmetricKeyAlgorithm can not be null");
}
/**
@@ -96,7 +115,7 @@ public class BasicJWKCredentialFactoryBean extends AbstractCredentialFactoryBean
}
jwkCredential.setPublicKey(((AsymmetricJWK) jwk).toPublicKey());
} else if (jwk.getKeyType() == KeyType.OCT) {
- jwkCredential.setSecretKey(((OctetSequenceKey) jwk).toSecretKey());
+ jwkCredential.setSecretKey(((OctetSequenceKey) jwk).toSecretKey(symmetricKeyAlgorithm));
} else {
throw new FatalBeanException("Unsupported KeyFile at " + jwkResource.getDescription());
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
index c340611..2fb158a 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
@@ -181,7 +181,7 @@ public class JWTDecrypter {
if (encryptedObject.getHeader().getKeyID() != null) {
// FIXME: This is created directly as an EvaluableCriterion as I can not see a way to
// add to the default mappings in EvaluableCredentialCriteriaRegistry without overriding the opensaml
- // version
+ // version. There is a hook for this, to add your own
newCriteriaSet.add(new EvaluableKeyIDCredentialCriterion(encryptedObject.getHeader().getKeyID()));
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list