[JIRA] (JCOMOIDC-62) Create new credential type for client_secret

[Philip Smart (Jira)]

Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 ) *created* an issue

Java Common OIDC Library ( https://shibboleth.atlassian.net/browse/JCOMOIDC?atlOrigin=eyJpIjoiN2EzZTFiYWRmMGM3NGJjMTk2MmFhYWM1YThkNDNiZDIiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/JCOMOIDC-62?atlOrigin=eyJpIjoiN2EzZTFiYWRmMGM3NGJjMTk2MmFhYWM1YThkNDNiZDIiLCJwIjoiaiJ9 ) JCOMOIDC-62 ( https://shibboleth.atlassian.net/browse/JCOMOIDC-62?atlOrigin=eyJpIjoiN2EzZTFiYWRmMGM3NGJjMTk2MmFhYWM1YThkNDNiZDIiLCJwIjoiaiJ9 ) Create new credential type for client_secret ( https://shibboleth.atlassian.net/browse/JCOMOIDC-62?atlOrigin=eyJpIjoiN2EzZTFiYWRmMGM3NGJjMTk2MmFhYWM1YThkNDNiZDIiLCJwIjoiaiJ9 )

Issue Type: Improvement Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Created: 20/Jan/23 9:48 AM Priority: Trivial Reporter: Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 )

The RP was building a client_secret as a credential. This made little sense because the client_secret is only directly a credential as a client credential for authentication to the token endpoint. For cryptographic operations, a key is derived from the client_secret, but the secret is never itself a key (although it is very close to one for MAC-signatures).

Anyway, the Credential interface specifies many attributes the client_secret does not have e.g. an algorithm or symmetric or asymmetric keys. Therefore, I aim to simplify its construction and allow a suitable key to be derived from the key (typically by resolvers) when needed.

This also has the benefit of moving that logic from the encrypted and decrypters. Which can not be more generic in saying, ‘encrypt with this key’, rather than, ‘Ah, this is a symmetric key and for OIDC this must be derived into something else’. So they just do what JWE tells them to.

( https://shibboleth.atlassian.net/browse/JCOMOIDC-62#add-comment?atlOrigin=eyJpIjoiN2EzZTFiYWRmMGM3NGJjMTk2MmFhYWM1YThkNDNiZDIiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JCOMOIDC-62#add-comment?atlOrigin=eyJpIjoiN2EzZTFiYWRmMGM3NGJjMTk2MmFhYWM1YThkNDNiZDIiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100214- sha1:fa7bc5f )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230120/64776f80/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-31bc2bce-a6c4-420d-9cb1-eba6ba703840
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230120/64776f80/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-7f87ca73-e24e-4502-9839-28b178c9bac1
Type: image/png
Size: 448 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230120/64776f80/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-1731ae80-69ec-4448-a7fc-f34d031d9f2d
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230120/64776f80/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-2fd1ccc7-b430-42a5-bedd-a207d365def8
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230120/64776f80/attachment-0007.png>