[java-oidc-common] branch main updated: Use algorithm priority in the basic signing params resolver

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=43625acfffabd23ffa0614ce31425d1a6fd77ec9

The following commit(s) were added to refs/heads/main by this push:
     new 43625ac  Use algorithm priority in the basic signing params resolver
43625ac is described below

commit 43625acfffabd23ffa0614ce31425d1a6fd77ec9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Feb 20 11:52:05 2023 +0000

    Use algorithm priority in the basic signing params resolver
    
     - As with other singing param resolvers, loop through the algorithms
    first to find a matching credential, rather than loop through the
    credentials to find a matching algorithm (e.g. algorithm from the config
    takes priority).
---
 .../security/jose/impl/BasicSignatureSigningParametersResolver.java  | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
index a896ce4..0e33854 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
@@ -205,8 +205,9 @@ public class BasicSignatureSigningParametersResolver
         final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
         log.trace("Resolved effective signature algorithms: {}", algorithms);
         
-        for (final Credential credential : credentials) {
-            for (final String algorithm : algorithms) {
+        // Pick the first credential that matches one of the supported algorithms. Take algorithm priority.
+        for (final String algorithm : algorithms) {
+            for (final Credential credential : credentials) {
                 if (log.isTraceEnabled()) {
                     final Key key = CredentialSupport.extractSigningKey(credential);  
                     log.trace("Evaluating credential '{}' of type '{}' against algorithm: {}",

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.