[java-oidc-common] branch dev/JCOMOIDC-48 updated: JCOMOIDC-64 - Support for the PS-* signature algorithms
Phil Smart
philip.smart at jisc.ac.uk
Wed Feb 1 14:11:48 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-48
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=78abb10d52443c22df6e141ffa5bbc3a383e3e70
The following commit(s) were added to refs/heads/dev/JCOMOIDC-48 by this push:
new 78abb10 JCOMOIDC-64 - Support for the PS-* signature algorithms
78abb10 is described below
commit 78abb10d52443c22df6e141ffa5bbc3a383e3e70
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Feb 1 14:11:45 2023 +0000
JCOMOIDC-64 - Support for the PS-* signature algorithms
- Add PS* algorithm descriptors
- Add algorithm descriptors to the algorithm list
- Add more tests
https://shibboleth.atlassian.net/browse/JCOMOIDC-64
---
.../jwa/algorithm/descriptors/SignaturePS256.java | 68 ++++++++++
.../jwa/algorithm/descriptors/SignaturePS384.java | 68 ++++++++++
.../jwa/algorithm/descriptors/SignaturePS512.java | 68 ++++++++++
.../oidc/jwa/support/JCAConstantExtension.java | 9 ++
...g.opensaml.xmlsec.algorithm.AlgorithmDescriptor | 3 +
.../oidc/security/impl/SignJWTHandlerTest.java | 22 +++
...asicSignatureSigningParametersResolverTest.java | 150 +++++++++++++++++++++
...tionSignatureSigningParametersResolverTest.java | 102 ++++++++++++++
8 files changed, 490 insertions(+)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignaturePS256.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignaturePS256.java
new file mode 100644
index 0000000..753d3da
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignaturePS256.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: PS256.
+ */
+public final class SignaturePS256 implements SignatureAlgorithm {
+
+
+ @Override
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+
+ @Override
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_PS_256;
+ }
+
+
+ @Override
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+
+ @Override
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstantExtension.SIGNATURE_RSASSA_PSS;
+ }
+
+
+ @Override
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA256;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignaturePS384.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignaturePS384.java
new file mode 100644
index 0000000..64f8703
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignaturePS384.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: PS384.
+ */
+public final class SignaturePS384 implements SignatureAlgorithm {
+
+
+ @Override
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+
+ @Override
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_PS_384;
+ }
+
+
+ @Override
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+
+ @Override
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstantExtension.SIGNATURE_RSASSA_PSS;
+ }
+
+
+ @Override
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA384;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignaturePS512.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignaturePS512.java
new file mode 100644
index 0000000..9fe2306
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignaturePS512.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: PS512.
+ */
+public final class SignaturePS512 implements SignatureAlgorithm {
+
+
+ @Override
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+
+ @Override
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_PS_512;
+ }
+
+
+ @Override
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+
+ @Override
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstantExtension.SIGNATURE_RSASSA_PSS;
+ }
+
+
+ @Override
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA512;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/JCAConstantExtension.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/JCAConstantExtension.java
index 87abb82..e807cf6 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/JCAConstantExtension.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/JCAConstantExtension.java
@@ -17,6 +17,8 @@
package net.shibboleth.oidc.jwa.support;
+import java.security.spec.PSSParameterSpec;
+
import org.opensaml.security.crypto.JCAConstants;
/**
@@ -33,6 +35,13 @@ public final class JCAConstantExtension {
/** Cipher padding "OAEP-256". */
public static final String CIPHER_PADDING_OAEP_256 = "OAEPWithSHA-256AndMGF1Padding";
+
+ /**
+ * RSASSA-PSS which uses SHA256/384/512 and MGF1 functions. Note, corresponds to JWA PS* signature schemes
+ * (e.g. PS256, PS384) which all share the same JCA algorithm name. A correct {@link PSSParameterSpec} will need to
+ * describe the correct Hash algorithm and Mask Generation Function used.
+ */
+ public static final String SIGNATURE_RSASSA_PSS = "RSASSA-PSS";
/** Private constructor. */
private JCAConstantExtension() {
diff --git a/oidc-common-crypto-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor b/oidc-common-crypto-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
index 1a40908..c5fd495 100644
--- a/oidc-common-crypto-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
+++ b/oidc-common-crypto-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
@@ -1,6 +1,9 @@
net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureRS256
net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureRS384
net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureRS512
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignaturePS256
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignaturePS384
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignaturePS512
net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureES256
net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureES384
net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureES512
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java
index a8e4872..23b1ff1 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java
@@ -173,5 +173,27 @@ public class SignJWTHandlerTest extends AbstractHandlerTest {
final var signedJWT = (SignedJWT)jwt;
AssertJUnit.assertTrue(JWSAlgorithm.Family.EC.contains(signedJWT.getHeader().getAlgorithm()));
}
+
+ @Test
+ public void testSignPS256_Success() throws Exception {
+
+ final SecurityParametersContext secParamCtx = new SecurityParametersContext();
+ final var params = new SignatureSigningParameters();
+ final RSAKey rsaKey = new RSAKeyGenerator(2048)
+ .keyID("1")
+ .keyUse(KeyUse.SIGNATURE)
+ .generate();
+ params.setSigningCredential(TestCredentialHelper.createAsymmetricSigningCredential(rsaKey));
+ params.setSignatureAlgorithm("PS256");
+ secParamCtx.setSignatureSigningParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ signer.initialize();
+ signer.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+ AssertJUnit.assertTrue(jwt instanceof SignedJWT);
+ final var signedJWT = (SignedJWT)jwt;
+ AssertJUnit.assertTrue(JWSAlgorithm.Family.RSA.contains(signedJWT.getHeader().getAlgorithm()));
+ }
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolverTest.java
new file mode 100644
index 0000000..9723de0
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolverTest.java
@@ -0,0 +1,150 @@
+
+package net.shibboleth.oidc.security.jose.impl;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertFalse;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertTrue;
+import static org.testng.Assert.fail;
+
+import java.util.Collections;
+import java.util.List;
+
+import org.opensaml.core.config.InitializationException;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jose.jwk.Curve;
+import com.nimbusds.jose.jwk.ECKey;
+import com.nimbusds.jose.jwk.KeyUse;
+import com.nimbusds.jose.jwk.RSAKey;
+import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
+import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
+import com.nimbusds.oauth2.sdk.ParseException;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+import net.shibboleth.oidc.security.impl.TestCredentialHelper;
+import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
+import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+
+/** Tests for the {@link BasicSignatureSigningParametersResolver}.*/
+public class BasicSignatureSigningParametersResolverTest {
+
+ /** The resolver to test.*/
+ private BasicSignatureSigningParametersResolver resolver;
+
+ @BeforeMethod
+ public void setup() throws Exception {
+
+ resolver = new BasicSignatureSigningParametersResolver();
+
+ //Create an algorithm registry here, as opensaml init will not take place for these tests
+ try {
+ final GlobalAlgorithmRegistryInitializer gar = new GlobalAlgorithmRegistryInitializer();
+ gar.init();
+ } catch (final InitializationException e) {
+ fail();
+ }
+ }
+
+ private CriteriaSet buildCriteria(final List<String> supportedSigningAlgos, final List<Credential> credentials)
+ throws ParseException {
+ final CriteriaSet crit = new CriteriaSet();
+ final BasicSignatureSigningConfiguration config = new BasicSignatureSigningConfiguration();
+ config.setSignatureAlgorithms(supportedSigningAlgos);
+ config.setSigningCredentials(credentials);
+ crit.add(new SignatureSigningConfigurationCriterion(List.of(config)));
+
+ return crit;
+ }
+
+ @Test
+ public void testResolveSuccess_HS256() throws Exception {
+
+ final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_256),
+ List.of(new DefaultClientSecretCredential("atestsecret").toSigningCredential()));
+
+ final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+ assertNotNull(params);
+ assertTrue(params.iterator().hasNext());
+ assertNotNull(params.iterator().next().getSigningCredential());
+ assertNotNull(params.iterator().next().getSigningCredential().getSecretKey());
+ }
+
+ @Test
+ public void testResolveSuccess_PS256() throws Exception {
+
+ final RSAKey keyRecipient = new RSAKeyGenerator(2048)
+ .keyID("1")
+ .keyUse(KeyUse.SIGNATURE)
+ .generate();
+
+ final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_PS_256),
+ List.of(TestCredentialHelper.createAsymmetricSigningCredential(keyRecipient)));
+
+ final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+ assertNotNull(params);
+ assertTrue(params.iterator().hasNext());
+ assertNotNull(params.iterator().next().getSigningCredential().getPrivateKey());
+ assertEquals(params.iterator().next().getSigningCredential().getPrivateKey().getAlgorithm(),"RSA");
+ }
+
+ @Test
+ public void testResolveSuccess_RS256() throws Exception {
+
+ final RSAKey keyRecipient = new RSAKeyGenerator(2048)
+ .keyID("1")
+ .keyUse(KeyUse.SIGNATURE)
+ .generate();
+
+ final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RS_256),
+ List.of(TestCredentialHelper.createAsymmetricSigningCredential(keyRecipient)));
+
+ final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+ assertNotNull(params);
+ assertTrue(params.iterator().hasNext());
+ assertNotNull(params.iterator().next().getSigningCredential());
+ assertNotNull(params.iterator().next().getSigningCredential().getPrivateKey());
+ assertEquals(params.iterator().next().getSigningCredential().getPrivateKey().getAlgorithm(),"RSA");
+ }
+
+ @Test
+ public void testResolveSuccess_ES256() throws Exception {
+
+ final ECKey keyRecipient = new ECKeyGenerator(Curve.P_256)
+ .keyID("1")
+ .keyUse(KeyUse.SIGNATURE)
+ .generate();
+
+ final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_ES_256),
+ List.of(TestCredentialHelper.createAsymmetricSigningCredential(keyRecipient)));
+
+ final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+ assertNotNull(params);
+ assertTrue(params.iterator().hasNext());
+ assertNotNull(params.iterator().next().getSigningCredential());
+ assertNotNull(params.iterator().next().getSigningCredential().getPrivateKey());
+ assertEquals(params.iterator().next().getSigningCredential().getPrivateKey().getAlgorithm(),"EC");
+ }
+
+ @Test
+ public void testResolveFail_NoSupportedAlgs() throws Exception {
+
+ final ECKey keyRecipient = new ECKeyGenerator(Curve.P_256)
+ .keyID("1")
+ .keyUse(KeyUse.SIGNATURE)
+ .generate();
+
+ final CriteriaSet criteria = buildCriteria(Collections.emptyList(),
+ List.of(TestCredentialHelper.createAsymmetricSigningCredential(keyRecipient)));
+
+ final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+ assertNotNull(params);
+ assertFalse(params.iterator().hasNext());
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java
new file mode 100644
index 0000000..e91145c
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java
@@ -0,0 +1,102 @@
+
+package net.shibboleth.oidc.security.jose.impl;
+
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertTrue;
+import static org.testng.Assert.fail;
+
+import java.io.InputStreamReader;
+import java.io.Reader;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.core.config.InitializationException;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.util.FileCopyUtils;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
+import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
+import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+
+public class ClientInformationSignatureSigningParametersResolverTest {
+
+ private static final ClassPathResource CLIENT_INFORMATION_SECRET =
+ new ClassPathResource("/metadata/test-resolver-client-information-secret.json");
+
+ private ClientInformationSignatureSigningParametersResolver resolver;
+
+ @BeforeMethod
+ public void setup() throws Exception {
+
+ //Create an algorithm registry here, as opensaml init will not take place for these tests
+ try {
+ final GlobalAlgorithmRegistryInitializer gar = new GlobalAlgorithmRegistryInitializer();
+ gar.init();
+ } catch (final InitializationException e) {
+ fail();
+ }
+ }
+
+ /**
+ * Read a file into a string.
+ *
+ * @param location the location of the file to read
+ *
+ * @return the file as a string
+ */
+ protected String readJsonFromFile(@Nonnull final Resource location) {
+ try (Reader reader = new InputStreamReader(location.getInputStream(), StandardCharsets.UTF_8)) {
+ return FileCopyUtils.copyToString(reader);
+ } catch (final Exception ex) {
+ fail();
+ return null;
+ }
+ }
+
+ private CriteriaSet buildCriteria(final List<String> supportedSigningAlgos, final List<Credential> credentials)
+ throws ParseException {
+ final CriteriaSet crit = new CriteriaSet();
+ final BasicSignatureSigningConfiguration config = new BasicSignatureSigningConfiguration();
+ config.setSignatureAlgorithms(supportedSigningAlgos);
+ config.setSigningCredentials(credentials);
+ crit.add(new SignatureSigningConfigurationCriterion(List.of(config)));
+ crit.add(new ClientInformationCriterion(OIDCClientInformation.parse(
+ JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_SECRET)))));
+ return crit;
+ }
+
+ @Test
+ public void testResolveSuccess_ClientSecretCredential() throws Exception {
+
+ // Specify the 'enabled' algorithms in the constructor function
+ resolver = new ClientInformationSignatureSigningParametersResolver(
+ metadata -> SignatureConstants.ALGO_ID_SIGNATURE_HS_256.toString(),
+ SignatureConstants.ALGO_ID_SIGNATURE_HS_256.toString());
+
+ final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_256),
+ List.of(new DefaultClientSecretCredential("atestsecret").toSigningCredential()));
+
+ final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+ assertNotNull(params);
+ assertTrue(params.iterator().hasNext());
+ assertNotNull(params.iterator().next().getSigningCredential());
+ assertNotNull(params.iterator().next().getSigningCredential().getSecretKey());
+ }
+
+ // TODO: Complete
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list