[java-idp-plugin-vci] branch main updated: minor rework on signing action

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/1ad3cc786a90014340a63baa5635adbaf30bcd38

The following commit(s) were added to refs/heads/main by this push:
     new 1ad3cc7  minor rework on signing action
1ad3cc7 is described below

commit 1ad3cc786a90014340a63baa5635adbaf30bcd38
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Wed Feb 25 07:40:25 2026 +0200

    minor rework on signing action
---
 .../openidvci/profile/impl/SignJWTCredential.java  | 39 +++++++++++++++++-----
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java
index 381a1ab..c3b4ca0 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java
@@ -34,12 +34,15 @@ import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
+import org.opensaml.security.credential.Credential;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import net.shibboleth.oidc.security.CredentialConversionUtil;
 import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
 import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.FunctionSupport;
@@ -56,6 +59,8 @@ import com.nimbusds.jwt.SignedJWT;
  * Action that signs all jwt verifiable credentials
  * {@link CredentialsContext#getJWTCredentials} storing the result to
  * {@link CredentialsContext#setSignedCredential}
+ * 
+ * TODO: Use generic JWSTokenSigner and modify it to support the case.
  */
 public class SignJWTCredential extends AbstractOIDCResponseAction {
 
@@ -78,9 +83,17 @@ public class SignJWTCredential extends AbstractOIDCResponseAction {
     private Function<ProfileRequestContext, String> issuerLookupStrategy;
 
     /** The signature signing parameters. */
-    @Nullable
+    @NonnullAfterInit
     private SignatureSigningParameters signatureSigningParameters;
 
+    /** Signing credential. */
+    @NonnullAfterInit
+    private Credential signingCredential;
+
+    /** EC private key for signing. */
+    @NonnullAfterInit
+    private ECPrivateKey privateKey;
+
     /** Strategy used to obtain the certificate chain for signing key. */
     @Nonnull
     private Function<SignatureSigningParameters, List<Base64>> certificateChainLookupStrategy;
@@ -163,12 +176,18 @@ public class SignJWTCredential extends AbstractOIDCResponseAction {
             log.debug("{} no signature signing parameters available", getLogPrefix());
             return false;
         }
-        assert signatureSigningParameters != null;
-        if (signatureSigningParameters.getSigningCredential() == null) {
-            log.debug("{} no signature signing credentials available", getLogPrefix());
+        signingCredential = signatureSigningParameters.getSigningCredential();
+        if (signingCredential == null) {
+            log.debug("{} no signature signing credential available", getLogPrefix());
             return false;
         }
-        return true;
+        if (signingCredential.getPrivateKey() instanceof final ECPrivateKey ecKey) {
+            privateKey = ecKey;
+            return true;
+        }
+        log.error("{} No EC private key as signing parameter", getLogPrefix());
+        ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
+        return false;
     }
 
     /** {@inheritDoc} */
@@ -181,17 +200,19 @@ public class SignJWTCredential extends AbstractOIDCResponseAction {
             return;
         }
         try {
-            ECPrivateKey key = ((ECPrivateKey) signatureSigningParameters.getSigningCredential().getPrivateKey());
-            ECDSASigner signer = new ECDSASigner(key);
-            List<String> credentials = new ArrayList<>();
+            //
+            // For now we support only EC family
+            final ECDSASigner signer = new ECDSASigner(privateKey);
+            final List<String> credentials = new ArrayList<>();
             ctx.getJWTCredentials().forEach(credential -> {
                 SignedJWT signedJWT = new SignedJWT(
                         new JWSHeader.Builder(new JWSAlgorithm(signatureSigningParameters.getSignatureAlgorithm()))
                                 .x509CertChain(certificateChainLookupStrategy.apply(signatureSigningParameters))
                                 .type(new JOSEObjectType(
                                         CredentialFormatToJoseType(ctx.getCredentialConfiguration().getFormat())))
-                                .keyID("signing").build(),
+                                .keyID(CredentialConversionUtil.resolveKid(signingCredential)).build(),
                         credential);
+
                 try {
                     signedJWT.sign(signer);
                 } catch (JOSEException e) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.