[java-oidc-common] branch main updated: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
Henri Mikkonen
henri.mikkonen at iki.fi
Mon Mar 13 16:04:59 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=fd0d5fa414e887e0c8582beb2cbe505292e3a758
The following commit(s) were added to refs/heads/main by this push:
new fd0d5fa JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
fd0d5fa is described below
commit fd0d5fa414e887e0c8582beb2cbe505292e3a758
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Mar 13 18:04:48 2023 +0200
JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-41
ClientInformationSignatureSigningParametersResolver now adds the client secret as credential
to the list of resolved signing credentials. This is expected by PopulateJWTSignatureSigningParametersHandler.
---
...ormationSignatureSigningParametersResolver.java | 40 +++++++++-
...tionSignatureSigningParametersResolverTest.java | 90 ++++++++++++++++++----
...est-resolver-client-information-secret-512.json | 9 +++
3 files changed, 122 insertions(+), 17 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java
index 614b260..6289077 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java
@@ -25,11 +25,13 @@ import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
@@ -84,10 +86,7 @@ public class ClientInformationSignatureSigningParametersResolver
@Nonnull protected List<String> getEffectiveSignatureAlgorithms(@Nonnull final CriteriaSet criteria,
@Nonnull final Predicate<String> includeExcludePredicate) {
final List<String> accumulator = super.getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
- OIDCClientInformation metadata = null;
- if (criteria.contains(ClientInformationCriterion.class)) {
- metadata = criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
- }
+ final OIDCClientInformation metadata = getClientInformation(criteria);
if (metadata == null) {
if (StringSupport.trimOrNull(defaultAlgorithmValue) != null) {
log.debug("No client information found from the criteria set, using default");
@@ -108,6 +107,39 @@ public class ClientInformationSignatureSigningParametersResolver
return convertIntoListIfEnabled(algorithm, accumulator);
}
+ /**
+ * Returns the client information from the given criteria set, if one was found.
+ *
+ * @param criteria the input criteria being evaluated
+ * @return the client information if it existed, null otherwise
+ */
+ @Nullable protected OIDCClientInformation getClientInformation(@Nonnull final CriteriaSet criteria) {
+ if (criteria.contains(ClientInformationCriterion.class)) {
+ return criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
+ }
+ return null;
+ }
+
+ /**
+ * Get the effective list of signing credentials to consider. Adds the client secret credential to the list
+ * provided by the base-class, if secret is set in the metadata.
+ *
+ * @param criteria the input criteria being evaluated
+ * @return the list of credentials
+ */
+ @Nonnull protected List<Credential> getEffectiveSigningCredentials(@Nonnull final CriteriaSet criteria) {
+ final List<Credential> accumulator = super.getEffectiveSigningCredentials(criteria);
+ final OIDCClientInformation metadata = getClientInformation(criteria);
+ if (metadata == null || metadata.getSecret() == null) {
+ log.debug("No client information found from the criteria set");
+ return accumulator;
+ }
+ final DefaultClientSecretCredential secretCredential =
+ new DefaultClientSecretCredential(metadata.getSecret().getValue());
+ accumulator.add(secretCredential.toSigningCredential());
+ return accumulator;
+ }
+
/**
* Returns the given algorithm in a {@link List} if it was enabled in the list of enabled algorithms. An empty
* list is returned if the algorithm was not enabled.
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java
index f185b4a..5103341 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java
@@ -1,19 +1,36 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
package net.shibboleth.oidc.security.jose.impl;
import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertFalse;
import static org.testng.Assert.assertTrue;
import static org.testng.Assert.fail;
import java.io.InputStreamReader;
import java.io.Reader;
import java.nio.charset.StandardCharsets;
+import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
import org.opensaml.core.config.InitializationException;
-import org.opensaml.security.credential.Credential;
import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
@@ -26,7 +43,6 @@ import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.oidc.jwa.support.SignatureConstants;
-import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
@@ -34,12 +50,12 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
public class ClientInformationSignatureSigningParametersResolverTest {
- /** A 256 bit client_secret.*/
- private static final String CLIENT_SECRET_256 = "!A%D*G-KaPdSgVkYp3s6v8y/B?E(H+Mb";
-
private static final ClassPathResource CLIENT_INFORMATION_SECRET =
new ClassPathResource("/metadata/test-resolver-client-information-secret.json");
-
+
+ private static final ClassPathResource CLIENT_INFORMATION_SECRET_512 =
+ new ClassPathResource("/metadata/test-resolver-client-information-secret-512.json");
+
private ClientInformationSignatureSigningParametersResolver resolver;
@BeforeMethod
@@ -70,20 +86,20 @@ public class ClientInformationSignatureSigningParametersResolverTest {
}
}
- private CriteriaSet buildCriteria(final List<String> supportedSigningAlgos, final List<Credential> credentials)
+ private CriteriaSet buildCriteria(final List<String> supportedSigningAlgos, final ClassPathResource resource)
throws ParseException {
final CriteriaSet crit = new CriteriaSet();
final BasicSignatureSigningConfiguration config = new BasicSignatureSigningConfiguration();
config.setSignatureAlgorithms(supportedSigningAlgos);
- config.setSigningCredentials(credentials);
+ config.setSigningCredentials(Collections.emptyList());
crit.add(new SignatureSigningConfigurationCriterion(List.of(config)));
crit.add(new ClientInformationCriterion(OIDCClientInformation.parse(
- JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_SECRET)))));
+ JSONObjectUtils.parse(readJsonFromFile(resource)))));
return crit;
}
@Test
- public void testResolveSuccess_ClientSecretCredential() throws Exception {
+ public void testResolveSuccess_ClientSecretCredential256() throws Exception {
// Specify the 'enabled' algorithms in the constructor function
resolver = new ClientInformationSignatureSigningParametersResolver(
@@ -91,7 +107,57 @@ public class ClientInformationSignatureSigningParametersResolverTest {
SignatureConstants.ALGO_ID_SIGNATURE_HS_256.toString());
final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_256),
- List.of(new DefaultClientSecretCredential(CLIENT_SECRET_256).toSigningCredential()));
+ CLIENT_INFORMATION_SECRET);
+
+ final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+ assertNotNull(params);
+ assertTrue(params.iterator().hasNext());
+ assertNotNull(params.iterator().next().getSigningCredential());
+ assertNotNull(params.iterator().next().getSigningCredential().getSecretKey());
+ }
+
+ @Test
+ public void testResolveSuccess_ClientSecretCredential256_tooStrongAlg() throws Exception {
+
+ // Specify the 'enabled' algorithms in the constructor function
+ resolver = new ClientInformationSignatureSigningParametersResolver(
+ metadata -> SignatureConstants.ALGO_ID_SIGNATURE_HS_512.toString(),
+ SignatureConstants.ALGO_ID_SIGNATURE_HS_512.toString());
+
+ final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_512),
+ CLIENT_INFORMATION_SECRET);
+
+ final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+ assertNotNull(params);
+ assertFalse(params.iterator().hasNext());
+ }
+
+ @Test
+ public void testResolveSuccess_ClientSecretCredential256_algNotEnabled() throws Exception {
+
+ // Specify the 'enabled' algorithms in the constructor function
+ resolver = new ClientInformationSignatureSigningParametersResolver(
+ metadata -> SignatureConstants.ALGO_ID_SIGNATURE_HS_256.toString(),
+ SignatureConstants.ALGO_ID_SIGNATURE_HS_256.toString());
+
+ final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_512,
+ SignatureConstants.ALGO_ID_SIGNATURE_HS_384), CLIENT_INFORMATION_SECRET);
+
+ final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+ assertNotNull(params);
+ assertFalse(params.iterator().hasNext());
+ }
+
+ @Test
+ public void testResolveSuccess_ClientSecretCredential512() throws Exception {
+
+ // Specify the 'enabled' algorithms in the constructor function
+ resolver = new ClientInformationSignatureSigningParametersResolver(
+ metadata -> SignatureConstants.ALGO_ID_SIGNATURE_HS_512.toString(),
+ SignatureConstants.ALGO_ID_SIGNATURE_HS_512.toString());
+
+ final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_512),
+ CLIENT_INFORMATION_SECRET_512);
final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
assertNotNull(params);
@@ -99,7 +165,5 @@ public class ClientInformationSignatureSigningParametersResolverTest {
assertNotNull(params.iterator().next().getSigningCredential());
assertNotNull(params.iterator().next().getSigningCredential().getSecretKey());
}
-
- // TODO: Complete
}
diff --git a/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-secret-512.json b/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-secret-512.json
new file mode 100644
index 0000000..ad694c4
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-secret-512.json
@@ -0,0 +1,9 @@
+ {
+ "client_name":"Example valid client information",
+ "scope":"openid phone profile email offline_access",
+ "redirect_uris":["https://localhost:9921/RP/callback"],
+ "client_id":"mymockclient",
+ "client_secret":"dFBg7w!z%C*F-JaNdRg34332s5v8fsdfdFBg7w!z%C*F-JaNdRg34332s5v8fsdf",
+ "response_types":["code"],
+ "grant_types":["authorization_code"]
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list