[java-oidc-common] branch main updated: Add keyId criterion to decrypter criteria set if present in the header
Phil Smart
philip.smart at jisc.ac.uk
Tue Jan 10 11:50:55 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=20461aeca29cfdf7e8d6d516481e908a46af7134
The following commit(s) were added to refs/heads/main by this push:
new 20461ae Add keyId criterion to decrypter criteria set if present in the header
20461ae is described below
commit 20461aeca29cfdf7e8d6d516481e908a46af7134
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Jan 10 11:50:52 2023 +0000
Add keyId criterion to decrypter criteria set if present in the header
---
.../oidc/security/impl/JWTDecrypter.java | 22 +++++++++++++++-------
.../oidc/security/impl/JWTDecrypterTest.java | 21 +++++++++------------
2 files changed, 24 insertions(+), 19 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
index 03c6a9f..e3326cc 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
@@ -67,7 +67,9 @@ import com.nimbusds.jwt.JWTParser;
import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.credential.JWKCredential;
+import net.shibboleth.oidc.security.credential.impl.EvaluableKeyIDCredentialCriterion;
import net.shibboleth.oidc.security.criterion.JOSEObjectCriterion;
+import net.shibboleth.oidc.security.criterion.KeyIdCriterion;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -171,6 +173,14 @@ public class JWTDecrypter {
criteria.forEach(newCriteriaSet::add);
}
+ // Specifically add a keyId criterion if available in the header
+ if (encryptedObject.getHeader().getKeyID() != null) {
+ final String keyId = encryptedObject.getHeader().getKeyID();
+ log.debug("Added keyID criteria: '{}'", keyId);
+ newCriteriaSet.add(new EvaluableKeyIDCredentialCriterion(
+ new KeyIdCriterion(keyId)));
+ }
+
// Add the entire object so the resolver can access it
newCriteriaSet.add(new JOSEObjectCriterion(encryptedObject));
@@ -248,13 +258,11 @@ public class JWTDecrypter {
criteriaSet.add(lengthCrit);
log.debug("Added decryption key length criteria from EncryptionMethod algorithm URI: {}", lengthCrit
.getKeyLength());
- } else {
- if (enc.cekBitLength() != 0) {
- lengthCrit = new KeyLengthCriterion(enc.cekBitLength());
- criteriaSet.add(lengthCrit);
- log.debug("Added decryption key length criteria from EncryptionMethod/KeySize: {}", lengthCrit
- .getKeyLength());
- }
+ } else if (enc.cekBitLength() != 0) {
+ lengthCrit = new KeyLengthCriterion(enc.cekBitLength());
+ criteriaSet.add(lengthCrit);
+ log.debug("Added decryption key length criteria from EncryptionMethod/KeySize: {}", lengthCrit
+ .getKeyLength());
}
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
index a54e30e..8f0de0c 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
@@ -54,8 +54,6 @@ import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.JWKCredential;
-import net.shibboleth.oidc.security.credential.impl.EvaluableKeyIDCredentialCriterion;
-import net.shibboleth.oidc.security.criterion.KeyIdCriterion;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -466,9 +464,12 @@ public class JWTDecrypterTest {
assertEquals(decryptedJWE.getJWTClaimsSet().getSubject(), "jdoe");
}
- /* There are two RSA keys, the first should fail to decrypt, second should work.*/
+ /*
+ * There are two RSA keys. The JWE does *not* contain a keyId, all resolved credentials will be tied one by one,
+ * the first should fail to decrypt, the second should work.
+ */
@Test
- void testDecryptionByKeyEncryption_TwoRSAKeysInCredentialSet() throws Exception {
+ void testDecryptionByKeyEncryption_TwoRSAKeysInCredentialSet_NoKeyIdInJOSEHeader() throws Exception {
final RSAKey key = new RSAKeyGenerator(2048)
.keyID("1")
@@ -483,7 +484,7 @@ public class JWTDecrypterTest {
final JWEObject jweObject =
new JWEObject(new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
.contentType("JWT")
- .keyID("2")
+ // Specifically do not add a keyId to the header
.build(),
new Payload(createdSignedJWT()));
@@ -499,9 +500,9 @@ public class JWTDecrypterTest {
assertEquals(decryptedJWE.getJWTClaimsSet().getSubject(), "jdoe");
}
- /* There are two RSA keys, as we supply a keyId criterion, only one should be tried.*/
+ /* There are two RSA keys, as the decrypter extracts the keyId as a criterion, only one should be tried.*/
@Test
- void testDecryptionByKeyEncryption_TwoRSAKeysInCredentialSet_FilterOnKeyId() throws Exception {
+ void testDecryptionByKeyEncryption_TwoRSAKeysInCredentialSet_FilteredOnKeyId() throws Exception {
final RSAKey key = new RSAKeyGenerator(2048)
.keyID("1")
@@ -523,11 +524,7 @@ public class JWTDecrypterTest {
jweObject.encrypt(new RSAEncrypter((RSAPublicKey) keyTwo.toPublicKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
- final var params = new JWTDecryptionParameters();
-
- //Add keyId criteria, should prevent the first key from being tried.
- params.getAdditionalCriteria().add(new EvaluableKeyIDCredentialCriterion(new KeyIdCriterion("2")));
-
+ final var params = new JWTDecryptionParameters();
params.setKEKCredentialResolver(new MockRSAKeysCriteriaFilteringCredentialResolver(List.of(key, keyTwo)));
decrypter = new JWTDecrypter(params);
final JWT decryptedJWE = decrypter.decrypt(jwe);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list