[java-idp-plugin-oidc-rp] branch main updated: Improve signing parameter resolver in-line with improvements in commons
Phil Smart
philip.smart at jisc.ac.uk
Mon Feb 20 13:15:43 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=e1be78a18bfd2b3694289310e436b67d726e94d2
The following commit(s) were added to refs/heads/main by this push:
new e1be78a Improve signing parameter resolver in-line with improvements in commons
e1be78a is described below
commit e1be78a18bfd2b3694289310e436b67d726e94d2
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Feb 20 13:15:38 2023 +0000
Improve signing parameter resolver in-line with improvements in commons
---
...RelyingPartyProxySigningParametersResolver.java | 78 +---------------------
1 file changed, 3 insertions(+), 75 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
index 854019c..f239b03 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
@@ -17,8 +17,6 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-import java.security.interfaces.ECPrivateKey;
-import java.security.interfaces.RSAPrivateKey;
import java.util.ArrayList;
import java.util.List;
import java.util.function.Function;
@@ -26,7 +24,6 @@ import java.util.function.Predicate;
import java.util.stream.Collectors;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
@@ -34,10 +31,8 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.jwk.Curve;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-import net.shibboleth.oidc.security.CredentialConversionUtil;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
@@ -119,31 +114,11 @@ public class RelyingPartyProxySigningParametersResolver extends BasicSignatureSi
log.debug("Resolved effective signature algorithms from config: '{}'", algorithms);
// Filter by those supported by the upstream OP
- final List<String> filteredAlgorithms = filterForProviderSupportedAlgorithms(criteria, algorithms);
- final List<JWSAlgorithm> supportedAlgorithms = convertSupportAlgorithmsToJwkAlgorithms(filteredAlgorithms);
+ final List<String> supportedAlgorithms = filterForProviderSupportedAlgorithms(criteria, algorithms);
log.trace("Resolved effective signature algorithms: {}", supportedAlgorithms);
- // Pick the first credential that matches one of the supported algorithms. Take algorithm priority.
- for (final JWSAlgorithm algorithm : supportedAlgorithms) {
- for (final Credential credential : allCredentials) {
- if (log.isTraceEnabled()) {
- log.trace("Evaluating signing credential '{}'", CredentialConversionUtil.resolveKid(credential));
- }
- final JWSAlgorithm foundSupportedAlgorithm =
- credentialSupportsSigningAlgorithm(credential, algorithm);
- if (foundSupportedAlgorithm != null) {
- log.trace("Credential supports algorithm '{}'", foundSupportedAlgorithm);
- params.setSigningCredential(credential);
- params.setSignatureAlgorithm(foundSupportedAlgorithm.getName());
- return;
- }
- if (log.isTraceEnabled()) {
- log.trace("Credential '{}' failed eval against Signing Algorithm '{}'",
- CredentialConversionUtil.resolveKid(credential), algorithm);
-
- }
- }
- }
+ findCompatibleAlgorithmAndCredential(supportedAlgorithms, allCredentials, params);
+
}
/**
@@ -157,53 +132,6 @@ public class RelyingPartyProxySigningParametersResolver extends BasicSignatureSi
return algos.stream().map(JWSAlgorithm::parse).collect(Collectors.toList());
}
- /**
- * Check the credential supports the algorithm input. If it does, the algorithm it supports
- * is returned. If none are supported, {@literal null} is returned.
- *
- * @param credential the credential to test
- * @param supportedAlgorithm the list of supported algorithms to check support for
- *
- * @return the supported algorithm, or {@literal null} if none are supported
- */
- @Nullable private JWSAlgorithm credentialSupportsSigningAlgorithm(@Nonnull final Credential credential,
- @Nonnull final JWSAlgorithm supportedAlgorithm) {
-
- if (JWSAlgorithm.Family.HMAC_SHA.contains(supportedAlgorithm) && credential.getSecretKey() != null ||
- (JWSAlgorithm.Family.RSA.contains(supportedAlgorithm) &&
- credential.getPrivateKey() instanceof RSAPrivateKey) ||
- (JWSAlgorithm.Family.EC.contains(supportedAlgorithm)
- && credential.getPrivateKey() instanceof ECPrivateKey
- && curveMatchesESAlgorithm(Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) credential.getPrivateKey()).getParams()),
- supportedAlgorithm))) {
- return supportedAlgorithm;
- }
- return null;
-
- }
-
- /**
- * Helper to match ECKey curve to JWS algorithm ES256, ES384 and ES512.
- *
- * @param curve curve to match.
- * @param algorithm algorithm to match.
- * @return true if key curve matches algorithm, otherwise false.
- */
- // TODO: Move to helper
- private boolean curveMatchesESAlgorithm(final Curve curve, final JWSAlgorithm algorithm) {
- if (algorithm.equals(JWSAlgorithm.ES256)) {
- return curve.equals(Curve.P_256);
- }
- if (algorithm.equals(JWSAlgorithm.ES384)) {
- return curve.equals(Curve.P_384);
- }
- if (algorithm.equals(JWSAlgorithm.ES512)) {
- return curve.equals(Curve.P_521);
- }
- return false;
- }
-
/**
* Filter the set of algorithms against the set supported by the OpenID Provider.
* Always returns a new list reference. The ordering of the input algorithms should be preserved.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list