[java-oidc-common] 02/03: Fix client information resolver to use new client_secret classes
Phil Smart
philip.smart at jisc.ac.uk
Fri Jan 27 15:14:59 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-62
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=dc8ee6dd422f870bddf17a1105450b1148e0d779
commit dc8ee6dd422f870bddf17a1105450b1148e0d779
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jan 27 11:13:40 2023 +0000
Fix client information resolver to use new client_secret classes
And change the way the credential is actually built.
---
.../credential/ClientSecretCredential.java | 4 +-
.../credential/DefaultClientSecretCredential.java | 1 +
.../credential/NimbusSecretCredential.java | 2 +-
.../impl/BasicJOSEObjectCredentialResolver.java | 74 ++++++++++++++++++++++
.../impl/ClientInformationCredentialResolver.java | 17 +++--
.../ClientSecretCriterionCredentialResolver.java | 70 +-------------------
.../impl/BaseJWTSignatureSecurityHandler.java | 4 +-
.../ClientInformationCredentialResolverTest.java | 3 +
...lientSecretCriterionCredentialResolverTest.java | 25 +++++---
.../oidc/security/impl/JWETokenDecrypterTest.java | 23 +++++--
10 files changed, 133 insertions(+), 90 deletions(-)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/ClientSecretCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/ClientSecretCredential.java
index b7f1c0f..15d8b2a 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/ClientSecretCredential.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/ClientSecretCredential.java
@@ -25,6 +25,8 @@ import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWEAlgorithm;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
/**
* Credential wrapping a client_secret. Contains methods to convert the client_secret into suitable keys used for
* signing and encryption.
@@ -38,7 +40,7 @@ public interface ClientSecretCredential {
*
* @return The client_secret.
*/
- @Nonnull String getSecret();
+ @Nonnull @NotEmpty String getSecret();
/**
* Get the client_secret as UTF-8 bytes.
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/DefaultClientSecretCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/DefaultClientSecretCredential.java
index 5d3a560..1af0841 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/DefaultClientSecretCredential.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/DefaultClientSecretCredential.java
@@ -103,6 +103,7 @@ public class DefaultClientSecretCredential implements ClientSecretCredential {
final BasicExpiringJWKCredential jwkCredential = new BasicExpiringJWKCredential();
jwkCredential.getKeyNames().add(secretKeyName);
jwkCredential.setKid(secretKeyName);
+ jwkCredential.setAlgorithm(alg);
jwkCredential.setUsageType(UsageType.ENCRYPTION);
jwkCredential.setSecretKey(key);
return jwkCredential;
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/NimbusSecretCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/NimbusSecretCredential.java
index 24a72c3..3e92b97 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/NimbusSecretCredential.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/NimbusSecretCredential.java
@@ -28,7 +28,7 @@ import com.nimbusds.oauth2.sdk.auth.Secret;
*
* @deprecated use {@link ClientSecretCredential}
*/
- at Deprecated
+ at Deprecated(since = "2.2.0", forRemoval=true)
public interface NimbusSecretCredential extends Credential {
/**
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
index f409a9c..60a605e 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
@@ -25,13 +25,17 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.UsageType;
import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
+import org.opensaml.security.criteria.UsageCriterion;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.Header;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JOSEObject;
+import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWEHeader;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.jwk.AsymmetricJWK;
@@ -43,6 +47,7 @@ import com.nimbusds.jose.jwk.RSAKey;
import net.shibboleth.oidc.security.CredentialConversionUtil;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.jose.criterion.JOSEObjectCriterion;
import net.shibboleth.oidc.security.jose.criterion.KeyIdCriterion;
@@ -236,4 +241,73 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
}
}
}
+
+ /**
+ * Use the usage type and algorithm information in the criteria to build a suitable signing or encryption
+ * credential.
+ *
+ * <p>Only supports symmetric key encryption algorithms. Request for asymmetric key encryption algorithms are
+ * ignored.</p>
+ *
+ * @param usageType are we creating a key suitable for MAC signing or encryption
+ * @param secretCred the raw client_secret credential
+ * @param criteriaSet the criteria set used to find algorithm details for encryption keys
+ *
+ * @return a suitable credential, or {@code null}.
+ *
+ * @throws ResolverException if there is an error deriving the key
+ */
+ @Nullable protected Credential deriveClientSecretCredential(@Nonnull final ClientSecretCredential secretCred,
+ @Nonnull final CriteriaSet criteriaSet) throws ResolverException {
+
+ final UsageCriterion usageTypeCriterion = criteriaSet.get(UsageCriterion.class);
+ if (usageTypeCriterion == null) {
+ log.trace("No usage type criterion supplied, unable to derive client_secret credential");
+ }
+ final UsageType usageType = usageTypeCriterion.getUsage();
+
+ if (usageType == UsageType.SIGNING) {
+ // Create a signing credential
+ final Credential signingCred = secretCred.toSigningCredential();
+ log.debug("Derived signing credential '{}'", signingCred.getKeyNames());
+ return signingCred;
+
+ } else if (usageType == UsageType.ENCRYPTION) {
+ // Create an encryption credential suitable for the algorithms specified
+ final KeyManagmentAlgorithmCriterion alg = criteriaSet.get(KeyManagmentAlgorithmCriterion.class);
+ if (alg == null) {
+ throw new ResolverException(
+ "Credential criteria set did not contain an instance of KeyManagmentAlgorithmCriterion");
+ }
+ // Technically the encryption method is only relevant to key derivation for the Direct Encryption mode
+ final DataEncryptionAlgorithmCriterion enc = criteriaSet.get(DataEncryptionAlgorithmCriterion.class);
+ if (enc == null) {
+ throw new ResolverException(
+ "Credential criteria set did not contain an instance of DataEncryptionAlgorithmCriterion");
+ }
+
+ // Can only derive symmetric key credentials, ignore if not
+ if (JWEAlgorithm.Family.SYMMETRIC.contains(JWEAlgorithm.parse(alg.getAlgorithm()))) {
+ try {
+ final Credential derivedCred = secretCred.toEncryptionCredential(
+ JWEAlgorithm.parse(alg.getAlgorithm()), EncryptionMethod.parse(enc.getEncAlgorithm()));
+
+ log.debug("Derived encryption credential '{}' from 'alg={}' and 'enc={}'", derivedCred.getKeyNames()
+ ,alg.getAlgorithm(), enc.getEncAlgorithm());
+ return derivedCred;
+
+ } catch (final JOSEException e) {
+ log.warn("Unable to derive symmetric encryption key from client_secret using 'alg={}' and 'enc={}'",
+ alg.getAlgorithm(), enc.getEncAlgorithm());
+ }
+ throw new ResolverException("Unable to create encryption key from client_secret");
+ } else {
+ log.trace("Asymmetric key requested, client_secret not appropriate");
+ }
+ } else {
+ log.trace("Client secret could not be derived, unknown usage type '{}'", usageType);
+ throw new ResolverException("Unable to create key from client_secret, incompatible usage type");
+ }
+ return null;
+ }
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
index cb1d8b8..ba86302 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
@@ -24,7 +24,6 @@ import java.util.Collections;
import java.util.LinkedHashSet;
import javax.annotation.Nonnull;
-import javax.crypto.spec.SecretKeySpec;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
@@ -37,8 +36,9 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.credential.ClientSecretCredential;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
-import net.shibboleth.oidc.security.impl.JWSAssemblyUtils;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
@@ -96,6 +96,8 @@ public class ClientInformationCredentialResolver extends BasicJOSEObjectCredenti
* @param interval What to set.
*/
public void setKeyFetchInterval(@Positive final Duration interval) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
Constraint.isFalse(interval == null || interval.isNegative(), "Remote key refresh must be greater than 0");
keyFetchInterval = interval;
}
@@ -143,9 +145,14 @@ public class ClientInformationCredentialResolver extends BasicJOSEObjectCredenti
final OIDCClientMetadata metadata = information.getOIDCMetadata();
if (information.getSecret() != null) {
- final BasicJWKCredential jwkCredential = new BasicJWKCredential();
- jwkCredential.setSecretKey(new SecretKeySpec(JWSAssemblyUtils.getSecretBytes(information.getSecret().getValue()), "AES"));
- credentials.add(jwkCredential);
+ try {
+ final ClientSecretCredential secretCred =
+ new DefaultClientSecretCredential(information.getSecret().getValue());
+ final Credential derivedCredential = deriveClientSecretCredential(secretCred, criteriaSet);
+ credentials.add(derivedCredential);
+ } catch (final ResolverException e) {
+ log.warn("Unable to derive a client_secret based credential", e);
+ }
}
final JWKSet keySet;
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java
index 9d5dd84..d4a5b7a 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java
@@ -23,17 +23,11 @@ import java.util.List;
import javax.annotation.Nonnull;
import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.UsageType;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import com.nimbusds.jose.EncryptionMethod;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWEAlgorithm;
-
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -42,8 +36,6 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
* Extracts a credential held inside the {@link ClientSecretCredentialCriterion} from the given criteria set.
* Supports credential filter via evaluable criterion.
*
- * <p>Only supports symmetric key algorithms. Request for assymetric key algorithms are ignored.</p>
- *
* <p>A different key credential is derived for different usage types. MAC ('signing') keys are generated directly off
* the UTF-8 octets of the client_secret. Encryption/Decryption keys are generated specifically for the key management
* mode and encryption algorithm pulled out of the criteria set —and as such, if these criteria do not exist, resolution
@@ -54,19 +46,6 @@ public class ClientSecretCriterionCredentialResolver extends BasicJOSEObjectCred
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ClientSecretCriterionCredentialResolver.class);
- /** The pre-determined usage type of the credential that is returned from the client_secret.*/
- @Nonnull private final UsageType forUsageType;
-
- /**
- *
- * Constructor.
- *
- * @param usage the usage type of the returned credential
- */
- public ClientSecretCriterionCredentialResolver(@Nonnull @ParameterName(name="usage") final UsageType usage) {
- forUsageType = Constraint.isNotNull(usage, "Usage can not be null");
- }
-
@Override
@Nonnull protected Iterable<Credential> resolveFromSource(@Nonnull final CriteriaSet criteriaSet)
throws ResolverException {
@@ -76,54 +55,11 @@ public class ClientSecretCriterionCredentialResolver extends BasicJOSEObjectCred
final ClientSecretCredentialCriterion credentialCriterion = criteriaSet.get(ClientSecretCredentialCriterion.class);
final ClientSecretCredential secretCred = credentialCriterion.getCredential();
log.debug("Found client secret credential");
- if (forUsageType == UsageType.SIGNING) {
- // Create a signing credential
- final Credential signingCred = secretCred.toSigningCredential();
- log.debug("Derived signing credential '{}'", signingCred.getKeyNames());
-
- return List.of(signingCred);
-
- } else if (forUsageType == UsageType.ENCRYPTION) {
- // Create an encryption credential suitable for the algorithms specified
- final KeyManagmentAlgorithmCriterion alg = criteriaSet.get(KeyManagmentAlgorithmCriterion.class);
- if (alg == null) {
- throw new ResolverException(
- "Credential criteria set did not contain an instance of KeyManagmentAlgorithmCriterion");
- }
- // Technically the encryption method is only relevant to key derivation for the Direct Encryption mode
- final DataEncryptionAlgorithmCriterion enc = criteriaSet.get(DataEncryptionAlgorithmCriterion.class);
- if (enc == null) {
- throw new ResolverException(
- "Credential criteria set did not contain an instance of DataEncryptionAlgorithmCriterion");
- }
-
- // Can only derive symmetric key credentials, ignore if not
- if (JWEAlgorithm.Family.SYMMETRIC.contains(JWEAlgorithm.parse(alg.getAlgorithm()))) {
- try {
- final Credential derivedCred = secretCred.toEncryptionCredential(JWEAlgorithm.parse(alg.getAlgorithm()),
- EncryptionMethod.parse(enc.getEncAlgorithm()));
-
- log.debug("Derived encryption credential '{}' from 'alg={}' and 'enc={}'", derivedCred.getKeyNames()
- ,alg.getAlgorithm(), enc.getEncAlgorithm());
- return List.of(derivedCred);
-
- } catch (final JOSEException e) {
- log.warn("Unable to derive symmetric encryption key from client_secret using 'alg={}' and 'enc={}'",
- alg.getAlgorithm(), enc.getEncAlgorithm());
- }
- throw new ResolverException("Unable to create encryption key from client_secret");
- } else {
- log.trace("Asymmetric key requested, client_secret not appropriate");
- return Collections.emptyList();
- }
- } else {
- throw new ResolverException("Unable to create key from client_secret, incompatible usage type");
- }
+ final Credential derivedCredential = deriveClientSecretCredential(secretCred, criteriaSet);
+ return derivedCredential != null ? List.of(derivedCredential) : Collections.emptyList();
} else {
log.debug("Criteria did not contain a StaticClientSecretCredentialCriterion");
return Collections.emptyList();
}
- }
-
-
+ }
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
index 3e1c0de..aea6f45 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
@@ -43,15 +43,15 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
-import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
+import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
/**
- * Base class for SAML security message handlers which evaluate a JWT signature with a signature trust engine.
+ * Base class for security message handlers which evaluate a JWT signature with a signature trust engine.
*/
public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSecurityHandler<SignedJWT> {
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
index 79d94ad..a2509de 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
@@ -86,6 +86,7 @@ public class ClientInformationCredentialResolverTest extends BaseMetadataCredent
assertEquals(credsList.size(), 0);
}
+ @Override
@Test
public void testFail_EmptyCriteria() throws Exception {
((InitializableComponent) resolver).initialize();
@@ -106,6 +107,8 @@ public class ClientInformationCredentialResolverTest extends BaseMetadataCredent
criteria.add(new ClientInformationCriterion(
OIDCClientInformation.parse(JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_SECRET)))));
+
+ criteria.add(new UsageCriterion(UsageType.SIGNING));
final Iterable<Credential> creds = resolver.resolve(criteria);
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java
index 6021c42..6dd5b2d 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java
@@ -14,6 +14,7 @@ import javax.crypto.SecretKey;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.UsageCriterion;
import org.testng.annotations.Test;
import com.nimbusds.jose.EncryptionMethod;
@@ -51,9 +52,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test
public void testResolveSigningKey() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.SIGNING);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.SIGNING));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
final Iterable<Credential> resolvedCredentials = resolver.resolve(set);
@@ -70,9 +72,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test(expectedExceptions = ResolverException.class)
public void testResolveIncompatibleUsageType() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.UNSPECIFIED);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.UNSPECIFIED));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.A128KW.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
@@ -82,9 +85,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test(expectedExceptions = ResolverException.class)
public void testResolveNoKeyAlogrithmCriterion() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
@@ -94,9 +98,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test(expectedExceptions = ResolverException.class)
public void testResolveNoDataEncryptionAlogrithmCriterion() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.A128KW.getName()));
final Iterable<Credential> resolvedCredentials = resolver.resolve(set);
@@ -105,9 +110,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test
public void testResolveKeyWrappingKey() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.A128KW.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
@@ -136,9 +142,10 @@ public class ClientSecretCriterionCredentialResolverTest {
.build(),
new Payload(createdSignedJWT()));
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.A128KW.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128GCM.getName()));
@@ -190,10 +197,11 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test
public void testResolveDirectEncryptionKey() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.DIR.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
final Iterable<Credential> resolvedCredentials = resolver.resolve(set);
@@ -212,9 +220,10 @@ public class ClientSecretCriterionCredentialResolverTest {
/* Should fail, as asymmetric key can not be created from client_secret.*/
@Test
public void testIncompatibleAlg() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.RSA_OAEP_256.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java
index faee700..93f97b4 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java
@@ -130,7 +130,7 @@ public class JWETokenDecrypterTest {
.build(),
new Payload(createdSignedJWT()));
final JWKCredential cred = TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A256GCM);
+ .toEncryptionCredential(JWEAlgorithm.A256KW, EncryptionMethod.A256GCM);
jweObject.encrypt(new AESEncrypter(cred.getSecretKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
@@ -141,7 +141,7 @@ public class JWETokenDecrypterTest {
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
try {
return TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A256GCM);
+ .toEncryptionCredential(JWEAlgorithm.A256KW, EncryptionMethod.A256GCM);
} catch (KeyException | JOSEException e) {
fail();
return null;
@@ -170,12 +170,12 @@ public class JWETokenDecrypterTest {
.build(),
new Payload(createdSignedJWT()));
final JWKCredential cred = TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A256GCM);
+ .toEncryptionCredential(JWEAlgorithm.A256KW, EncryptionMethod.A256GCM);
jweObject.encrypt(new AESEncrypter(cred.getSecretKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new DecryptionParameters();
- params.setKEKCredentialResolver(new MockKeyWrapCriteriaFilteringCredentialResolver());
+ params.setKEKCredentialResolver(new MockKeyWrapCriteriaFilteringCredentialResolver(JWEAlgorithm.A256KW, EncryptionMethod.A256GCM));
decrypter = new JWETokenDecrypter(params);
final JWT decryptedJWE = decrypter.decrypt(jwe);
assertTrue(jwe.getState() == State.DECRYPTED);
@@ -321,7 +321,8 @@ public class JWETokenDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new DecryptionParameters();
- params.setContentEncryptionKeyCredentialResolver(new MockKeyWrapCriteriaFilteringCredentialResolver());
+ params.setContentEncryptionKeyCredentialResolver(
+ new MockKeyWrapCriteriaFilteringCredentialResolver(JWEAlgorithm.DIR, EncryptionMethod.A256GCM));
decrypter = new JWETokenDecrypter(params);
final JWT decryptedJWE = decrypter.decrypt(jwe);
assertTrue(jwe.getState() == State.DECRYPTED);
@@ -744,12 +745,22 @@ public class JWETokenDecrypterTest {
private static class MockKeyWrapCriteriaFilteringCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
implements JOSEObjectCredentialResolver {
+
+ private final JWEAlgorithm alg;
+
+ private final EncryptionMethod enc;
+
+ public MockKeyWrapCriteriaFilteringCredentialResolver(
+ final JWEAlgorithm algorithm, final EncryptionMethod encryption) {
+ alg = algorithm;
+ enc = encryption;
+ }
@Override
protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
try {
return List.of(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A256GCM));
+ .toEncryptionCredential(alg, enc));
} catch (KeyException | JOSEException e) {
fail();
return null;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list