[java-oidc-common] branch main updated: Add test for two RSA keys. Add test for two RSA keys filtered by keyId
Phil Smart
philip.smart at jisc.ac.uk
Tue Jan 10 09:57:05 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=59eaa167f6d00e0944b639606566c7c3870b06b5
The following commit(s) were added to refs/heads/main by this push:
new 59eaa16 Add test for two RSA keys. Add test for two RSA keys filtered by keyId
59eaa16 is described below
commit 59eaa167f6d00e0944b639606566c7c3870b06b5
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Jan 10 09:57:03 2023 +0000
Add test for two RSA keys. Add test for two RSA keys filtered by keyId
---
.../oidc/security/impl/JWTDecrypterTest.java | 131 +++++++++++++++++++--
1 file changed, 119 insertions(+), 12 deletions(-)
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
index e1b414d..a54e30e 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
@@ -9,6 +9,7 @@ import java.security.KeyException;
import java.security.interfaces.RSAPublicKey;
import java.text.ParseException;
import java.time.Instant;
+import java.util.ArrayList;
import java.util.Date;
import java.util.List;
@@ -53,6 +54,8 @@ import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.JWKCredential;
+import net.shibboleth.oidc.security.credential.impl.EvaluableKeyIDCredentialCriterion;
+import net.shibboleth.oidc.security.criterion.KeyIdCriterion;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -401,7 +404,7 @@ public class JWTDecrypterTest {
final JWEObject jweObject =
new JWEObject(new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
.contentType("JWT")
- .keyID("mock-key")
+ .keyID("1")
.build(),
new Payload(createdSignedJWT()));
jweObject.encrypt(new RSAEncrypter((RSAPublicKey) key.toPublicKey()));
@@ -413,8 +416,8 @@ public class JWTDecrypterTest {
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.RSA_OAEP_256);
- jwkCredential.getKeyNames().add("mock-key");
- jwkCredential.setKid("mock-key");
+ jwkCredential.getKeyNames().add(key.getKeyID());
+ jwkCredential.setKid(key.getKeyID());
try {
jwkCredential.setPrivateKey(key.toPrivateKey());
jwkCredential.setPublicKey(key.toPublicKey());
@@ -437,6 +440,7 @@ public class JWTDecrypterTest {
assertEquals(decryptedJWE.getJWTClaimsSet().getSubject(), "jdoe");
}
+ /* Same as testDecryptionByKeyEncryption but using a resolver that supports credential filtering.*/
@Test
void testDecryptionByKeyEncryption_Using_EvaluableCriteriaFiltering() throws Exception {
@@ -448,7 +452,7 @@ public class JWTDecrypterTest {
final JWEObject jweObject =
new JWEObject(new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
.contentType("JWT")
- .keyID("mock-key")
+ .keyID("1")
.build(),
new Payload(createdSignedJWT()));
jweObject.encrypt(new RSAEncrypter((RSAPublicKey) key.toPublicKey()));
@@ -462,6 +466,76 @@ public class JWTDecrypterTest {
assertEquals(decryptedJWE.getJWTClaimsSet().getSubject(), "jdoe");
}
+ /* There are two RSA keys, the first should fail to decrypt, second should work.*/
+ @Test
+ void testDecryptionByKeyEncryption_TwoRSAKeysInCredentialSet() throws Exception {
+
+ final RSAKey key = new RSAKeyGenerator(2048)
+ .keyID("1")
+ .keyUse(KeyUse.ENCRYPTION)
+ .generate();
+ // Use this one
+ final RSAKey keyTwo = new RSAKeyGenerator(2048)
+ .keyID("2")
+ .keyUse(KeyUse.ENCRYPTION)
+ .generate();
+
+ final JWEObject jweObject =
+ new JWEObject(new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
+ .contentType("JWT")
+ .keyID("2")
+ .build(),
+ new Payload(createdSignedJWT()));
+
+ jweObject.encrypt(new RSAEncrypter((RSAPublicKey) keyTwo.toPublicKey()));
+ final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
+
+ final var params = new JWTDecryptionParameters();
+ params.setKEKCredentialResolver(new MockRSAKeysCriteriaFilteringCredentialResolver(List.of(key, keyTwo)));
+ decrypter = new JWTDecrypter(params);
+ final JWT decryptedJWE = decrypter.decrypt(jwe);
+ assertTrue(jwe.getState() == State.DECRYPTED);
+ assertTrue(decryptedJWE instanceof SignedJWT);
+ assertEquals(decryptedJWE.getJWTClaimsSet().getSubject(), "jdoe");
+ }
+
+ /* There are two RSA keys, as we supply a keyId criterion, only one should be tried.*/
+ @Test
+ void testDecryptionByKeyEncryption_TwoRSAKeysInCredentialSet_FilterOnKeyId() throws Exception {
+
+ final RSAKey key = new RSAKeyGenerator(2048)
+ .keyID("1")
+ .keyUse(KeyUse.ENCRYPTION)
+ .generate();
+ // Use this one
+ final RSAKey keyTwo = new RSAKeyGenerator(2048)
+ .keyID("2")
+ .keyUse(KeyUse.ENCRYPTION)
+ .generate();
+
+ final JWEObject jweObject =
+ new JWEObject(new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
+ .contentType("JWT")
+ .keyID("2")
+ .build(),
+ new Payload(createdSignedJWT()));
+
+ jweObject.encrypt(new RSAEncrypter((RSAPublicKey) keyTwo.toPublicKey()));
+ final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
+
+ final var params = new JWTDecryptionParameters();
+
+ //Add keyId criteria, should prevent the first key from being tried.
+ params.getAdditionalCriteria().add(new EvaluableKeyIDCredentialCriterion(new KeyIdCriterion("2")));
+
+ params.setKEKCredentialResolver(new MockRSAKeysCriteriaFilteringCredentialResolver(List.of(key, keyTwo)));
+ decrypter = new JWTDecrypter(params);
+ final JWT decryptedJWE = decrypter.decrypt(jwe);
+ assertTrue(jwe.getState() == State.DECRYPTED);
+ assertTrue(decryptedJWE instanceof SignedJWT);
+ assertEquals(decryptedJWE.getJWTClaimsSet().getSubject(), "jdoe");
+ }
+
@Test
void testDecryptionByKeyAgreement() throws Exception {
@@ -473,7 +547,7 @@ public class JWTDecrypterTest {
final JWEObject jweObject =
new JWEObject(new JWEHeader.Builder(JWEAlgorithm.ECDH_ES_A256KW, EncryptionMethod.A256GCM)
.contentType("JWT")
- .keyID("mock-key")
+ .keyID("1")
.build(),
new Payload(createdSignedJWT()));
jweObject.encrypt(new ECDHEncrypter(key.toECPublicKey()));
@@ -485,8 +559,8 @@ public class JWTDecrypterTest {
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.ECDH_ES_A256KW);
- jwkCredential.getKeyNames().add("mock-key");
- jwkCredential.setKid("mock-key");
+ jwkCredential.getKeyNames().add(key.getKeyID());
+ jwkCredential.setKid(key.getKeyID());
try {
jwkCredential.setPrivateKey(key.toPrivateKey());
jwkCredential.setPublicKey(key.toPublicKey());
@@ -509,6 +583,7 @@ public class JWTDecrypterTest {
assertEquals(decryptedJWE.getJWTClaimsSet().getSubject(), "jdoe");
}
+ /* Is really the same as testDecryptionByKeyAgreement, but uses a resolver than accepts credential filtering.*/
@Test
void testDecryptionByKeyAgreement_Using_EvaluableCriteriaFiltering() throws Exception {
@@ -520,7 +595,7 @@ public class JWTDecrypterTest {
final JWEObject jweObject =
new JWEObject(new JWEHeader.Builder(JWEAlgorithm.ECDH_ES_A256KW, EncryptionMethod.A256GCM)
.contentType("JWT")
- .keyID("mock-key")
+ .keyID("1")
.build(),
new Payload(createdSignedJWT()));
jweObject.encrypt(new ECDHEncrypter(key.toECPublicKey()));
@@ -547,8 +622,8 @@ public class JWTDecrypterTest {
protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.RSA_OAEP_256);
- jwkCredential.getKeyNames().add("mock-key");
- jwkCredential.setKid("mock-key");
+ jwkCredential.getKeyNames().add(key.getKeyID());
+ jwkCredential.setKid(key.getKeyID());
try {
jwkCredential.setPrivateKey(key.toPrivateKey());
jwkCredential.setPublicKey(key.toPublicKey());
@@ -561,6 +636,38 @@ public class JWTDecrypterTest {
}
+ /* Same as MockRSACriteriaFilteringCredentialResolver but accepts a list of keys.*/
+ private static class MockRSAKeysCriteriaFilteringCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
+ implements JOSEObjectCredentialResolver {
+
+ private final List<RSAKey> keys;
+
+ public MockRSAKeysCriteriaFilteringCredentialResolver(final List<RSAKey> theKey) {
+ keys = theKey;
+ }
+
+ @Override
+ protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
+ final List<Credential> creds = new ArrayList<>();
+ for (final RSAKey key : keys) {
+ final BasicJWKCredential jwkCredential = new BasicJWKCredential();
+ jwkCredential.setAlgorithm(JWEAlgorithm.RSA_OAEP_256);
+ jwkCredential.getKeyNames().add(key.getKeyID());
+ jwkCredential.setKid(key.getKeyID());
+ try {
+ jwkCredential.setPrivateKey(key.toPrivateKey());
+ jwkCredential.setPublicKey(key.toPublicKey());
+ } catch (final JOSEException e) {
+ fail();
+ }
+ creds.add(jwkCredential);
+ }
+
+ return creds;
+ }
+
+ }
+
private static class MockDirCriteriaFilteringCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
implements JOSEObjectCredentialResolver {
@@ -614,8 +721,8 @@ public class JWTDecrypterTest {
protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.ECDH_ES_A256KW);
- jwkCredential.getKeyNames().add("mock-key");
- jwkCredential.setKid("mock-key");
+ jwkCredential.getKeyNames().add(key.getKeyID());
+ jwkCredential.setKid(key.getKeyID());
try {
jwkCredential.setPrivateKey(key.toPrivateKey());
jwkCredential.setPublicKey(key.toPublicKey());
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list