[java-idp-oidc] 02/02: Exploit alg inclusion/exclusion config when publishing supported algs.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=16401cf4070e73bc6fa038da3bd0ba9fbedb81e7

commit 16401cf4070e73bc6fa038da3bd0ba9fbedb81e7
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Apr 28 16:40:01 2023 +0300

    Exploit alg inclusion/exclusion config when publishing supported algs.
    
    The test relying-party configuration has excluded three algorithms.
---
 .../impl/AlgorithmInfoMetadataValueResolver.java   | 39 +++++++++++++++++-----
 .../op/profile/flow/ConfigurationFlowTest.java     | 12 ++++---
 2 files changed, 37 insertions(+), 14 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/AlgorithmInfoMetadataValueResolver.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/AlgorithmInfoMetadataValueResolver.java
index 74f08ec6..f888a02c 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/AlgorithmInfoMetadataValueResolver.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/AlgorithmInfoMetadataValueResolver.java
@@ -27,6 +27,8 @@ import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -132,30 +134,49 @@ public class AlgorithmInfoMetadataValueResolver extends AbstractIdentifiableInit
         }
         final JSONSecurityConfiguration jsonSecurityConfig = (JSONSecurityConfiguration) securityConfig;
         
-        final List<String> algorithms;
+        final List<String> algorithms = new ArrayList<>();
         if (resolveEncryptionAlgs) {
             final EncryptionConfiguration encryptionConfig = jsonSecurityConfig.getJwtEncryptionConfiguration();
             if (encryptionConfig != null) {
                 if (resolveKeyTransportEncAlgs) {
-                    algorithms = encryptionConfig.getKeyTransportEncryptionAlgorithms();
+                    populateAlgorithmsAgainstPolicy(algorithms, encryptionConfig.getKeyTransportEncryptionAlgorithms(),
+                            encryptionConfig);
                 } else {
-                    algorithms = encryptionConfig.getDataEncryptionAlgorithms();
+                    populateAlgorithmsAgainstPolicy(algorithms, encryptionConfig.getDataEncryptionAlgorithms(),
+                            encryptionConfig);
                 }
-            } else {
-                algorithms = new ArrayList<String>();
             }
         } else {
-            final SignatureSigningConfiguration signingConfig = jsonSecurityConfig.getJwtSignatureSigningConfiguration();
+            final SignatureSigningConfiguration signingConfig = 
+                    jsonSecurityConfig.getJwtSignatureSigningConfiguration();
             if (signingConfig != null) {
-                algorithms = signingConfig.getSignatureAlgorithms();
-            } else {
-                algorithms = new ArrayList<String>();
+                populateAlgorithmsAgainstPolicy(algorithms, signingConfig.getSignatureAlgorithms(), signingConfig);
             }
         }
         result.add(algorithms);
         return result;
     }
 
+    /**
+     * Verifies the candidates against given policy (inclusion/exclusion) and adds the passed ones to the given list.
+     * 
+     * @param algorithms the list where to store the passed candidates
+     * @param candidates the candidates to be verified
+     * @param policy the policy to be verified against
+     */
+    protected void populateAlgorithmsAgainstPolicy(final List<String> algorithms, final List<String> candidates,
+            final AlgorithmPolicyConfiguration policy) {
+        for (final String candidate : candidates) {
+            if (!AlgorithmSupport.validateAlgorithmURI(candidate, 
+                    policy.getIncludedAlgorithms(), 
+                    policy.getExcludedAlgorithms())) {
+                log.debug("Algorithm failed include/exclude validation: {}", candidate);
+                continue;
+            }
+            algorithms.add(candidate);
+        }
+    }
+    
     /** {@inheritDoc} */
     @Override
     public Object resolveSingle(@Nullable final ProfileRequestContext profileRequestContext) throws ResolverException {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
index 9665cc16..c247db05 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
@@ -64,13 +64,15 @@ public class ConfigurationFlowTest extends AbstractOidcFlowTest {
         Assert.assertNull(originalMetadata.getUserInfoJWSAlgs());
         final OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(response.toHTTPResponse().getContent());
         Assert.assertEquals(metadata.getIssuer(), new Issuer("https://op.example.org"));;
-        final List<String> jweAlgs = Arrays.asList("RSA1_5", "RSA-OAEP", "RSA-OAEP-256", "RSA-OAEP-384", "RSA-OAEP-512",
+        // all but RSA-OAEP-384 as it's excluded in test relying-party.xml
+        final List<String> jweAlgs = Arrays.asList("RSA1_5", "RSA-OAEP", "RSA-OAEP-256", "RSA-OAEP-512",
                 "A128KW", "A192KW", "A256KW", "A128GCMKW", "A192GCMKW", "A256GCMKW", "ECDH-ES", "ECDH-ES+A128KW",
                 "ECDH-ES+A192KW", "ECDH-ES+A256KW");
-        final List<String> jweEncs = Arrays.asList("A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512", "A128GCM", 
-                "A192GCM", "A256GCM");
-        final List<String> jwsAlgs = Arrays.asList("RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "HS256",
-                "HS384", "HS512", "PS256", "PS384", "PS512");
+        // all but A192CBC-HS384 as it's excluded in test relying-party.xml
+        final List<String> jweEncs = Arrays.asList("A128CBC-HS256", "A256CBC-HS512", "A128GCM", "A192GCM", "A256GCM");
+        // all but ES384 as it's excluded in test relying-party.xml
+        final List<String> jwsAlgs = Arrays.asList("RS256", "RS384", "RS512", "ES256", "ES512", "HS256", "HS384",
+                "HS512", "PS256", "PS384", "PS512");
         Assert.assertNotNull(metadata.getIDTokenJWEAlgs());
         Assert.assertTrue(containsAll(metadata.getIDTokenJWEAlgs(), jweAlgs));
         Assert.assertNotNull(metadata.getIDTokenJWEAlgs());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.