[java-oidc-common] branch main updated: Corrected the order of key transport vs data encryption algorithm lookups.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=0a2310a83c4acd153b664f34406a391c4d9497d0

The following commit(s) were added to refs/heads/main by this push:
     new 0a2310a  Corrected the order of key transport vs data encryption algorithm lookups.
0a2310a is described below

commit 0a2310a83c4acd153b664f34406a391c4d9497d0
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Apr 25 14:57:07 2023 +0300

    Corrected the order of key transport vs data encryption algorithm lookups.
    
    Key transport algorithm lookup is related to Nimbus JWEAlgorithm and data encryption
    algoritm to Nimbus EncryptionMethod.
---
 .../oidc/security/impl/CheckClientJWTDecryptionConfiguration.java | 4 ++--
 .../security/impl/CheckClientJWTDecryptionConfigurationTest.java  | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java
index aee24bc..8a62300 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java
@@ -206,7 +206,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
 
         final String tokenJweAlgorithm = jweHeader.getAlgorithm().getName();
         final String expectedJweAlgorithm = clientInformation == null ? 
-                null : dataEncryptionAlgorithmLookupStrategy.apply(clientInformation);
+                null : keyTransportEncryptionAlgorithmLookupStrategy.apply(clientInformation);
        
         if (StringSupport.trimOrNull(expectedJweAlgorithm) == null) {
             log.debug("{} No expected algorithm defined, accepting {} from the token", getLogPrefix(),
@@ -222,7 +222,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
 
         final String tokenEncryptionMethod = jweHeader.getEncryptionMethod().getName();
         final String expectedEncryptionMethod = clientInformation == null ?
-                null : keyTransportEncryptionAlgorithmLookupStrategy.apply(clientInformation);
+                null : dataEncryptionAlgorithmLookupStrategy.apply(clientInformation);
 
         if (StringSupport.trimOrNull(expectedEncryptionMethod) == null) {
             log.debug("{} No expected encryption method defined, accepting {} from the token", getLogPrefix(),
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfigurationTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfigurationTest.java
index 579a782..d17eb99 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfigurationTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfigurationTest.java
@@ -158,14 +158,14 @@ public class CheckClientJWTDecryptionConfigurationTest {
 
     @Test
     public void execute_noDataAlgMatch_returnsError() throws ComponentInitializationException {
-        setup(mockEncryptedJWT(), true, "mockDataAlgNOT", null);
+        setup(mockEncryptedJWT(), true, "mockDataAlgNOT", "mockKeyAlgId");
         ActionTestingSupport.assertEvent(action.execute(new RequestContextBuilder().buildRequestContext()),
                 eventId);
     }
 
     @Test
     public void execute_noKeyTransportAlgMatch_returnsError() throws ComponentInitializationException {
-        setup(mockEncryptedJWT(), true, null, "mockKeyAlgNOT");
+        setup(mockEncryptedJWT(), true, "mockDataAlgId", "mockKeyAlgNOT");
         ActionTestingSupport.assertEvent(action.execute(new RequestContextBuilder().buildRequestContext()),
                 eventId);
     }
@@ -179,8 +179,8 @@ public class CheckClientJWTDecryptionConfigurationTest {
 
     protected EncryptedJWT mockEncryptedJWT() {
         EncryptedJWT jwt = Mockito.mock(EncryptedJWT.class);
-        Mockito.when(jwt.getHeader()).thenReturn(new JWEHeader(JWEAlgorithm.parse("mockDataAlgId"),
-                EncryptionMethod.parse("mockKeyAlgId")));
+        Mockito.when(jwt.getHeader()).thenReturn(new JWEHeader(JWEAlgorithm.parse("mockKeyAlgId"),
+                EncryptionMethod.parse("mockDataAlgId")));
         return jwt;
     }
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.