feat(jans-auth-server): extending crypto support sub pr4 #670
Conversation
| @@ -90,13 +142,17 @@ public JSONArray toJSONArray() throws JSONException { | |||
| public String toString() { | |||
| try { | |||
| StringWriter stringWriter = new StringWriter(); | |||
| try (JcaPEMWriter pemWriter = new JcaPEMWriter(stringWriter)) { | |||
There was a problem hiding this comment.
try-resource statement looks better, is there any reason with replacing it with manual close()?
| default: { | ||
| throw new SignatureException(String.format("Wrong type of the signature algorithm (SignatureAlgorithm): %s", signatureAlgorithm.toString())); | ||
| } | ||
| switch(signatureAlgorithm) { |
| * @author Sergey Manoylo | ||
| * @version January 20, 2021 | ||
| */ | ||
| public class EDDSASigner extends AbstractJwsSigner { |
There was a problem hiding this comment.
EDDSASigner class is present but I don't see any usage of these class in entire PR. Maybe add test to see it in action.
There was a problem hiding this comment.
We have tests for EDDSASigner, of course (in
the branch jans-auth-server-extending-crypto-support-full).
for example:
This branch:
jans-auth-server-extending-crypto-support-full
contains fixed working (PASSED) tests in the JwtCrossCheckTest (where checking signings oxAuth <-> Nimbus is provided).
In the branch: jans-auth-server-extending-crypto-support-full
class EDDSASigner is used in the
package io.jans.as.server.bcauthorize.ws.rs.BackchannelAuthorizeRestWebServiceImpl
boolean validSignature = false;
JwsSigner jwsSigner = null;
switch(algorithm.getFamily()) {
case RSA: {
RSAPublicKey publicKey = JwkClient.getRSAPublicKey(client.getJwksUri(), keyId);
jwsSigner = new RSASigner(algorithm, publicKey);
break;
}
case EC: {
ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(client.getJwksUri(), keyId);
jwsSigner = new ECDSASigner(algorithm, publicKey);
break;
}
case ED: {
EDDSAPublicKey publicKey = JwkClient.getEDDSAPublicKey(client.getJwksUri(), keyId);
jwsSigner = new EDDSASigner(algorithm, publicKey);
break;
}
default: {
break;
}
}
if(jwsSigner != null) {
validSignature = jwsSigner.validate(jwt);
}
together with (ECDSASigner, RSASigner).
I can move these changes in this PR, NP, but also I need to change the JwkClient class,
as this is a new function: JwkClient.getEDDSAPublicKey.
Also EDDSASigner is used by the JwtVerifier class (in the branch: jans-auth-server-extending-crypto-support-full).
There are unit tests for JwtVerifier too:
I hope, all this code will be moved to the main in next PRs.
There was a problem hiding this comment.
I see, ok, lets get this PR first and in next PR test for it. Not ideal but we have to move forward somehow.
| X509EncodedKeySpec publicKeySpec = eddsaPublicKey.getPublicKeySpec(); | ||
| java.security.KeyFactory keyFactory = java.security.KeyFactory.getInstance(signatureAlgorithm.getName()); | ||
| BCEdDSAPublicKey publicKey = (BCEdDSAPublicKey) keyFactory.generatePublic(publicKeySpec); | ||
| Signature virifier = Signature.getInstance(signatureAlgorithm.getName(), "BC"); |
There was a problem hiding this comment.
DEF_BC instead of "BC" ? Lets use everywhere "BC" or otherwise DEF_BC. Mix does not look consistent.
| BCRSAPublicKey publicKey = (BCRSAPublicKey) x509Certificate.getPublicKey(); | ||
|
|
||
| rsaPublicKey = new RSAPublicKey(publicKey.getModulus(), publicKey.getPublicExponent()); | ||
| if (x509Certificate != null) { |
There was a problem hiding this comment.
Lets do early exit. We have big problems with nested ifs in bigger methods.
ìf (x509Certificate == null) {
return null;
}
| public ECDSAPublicKey getEcdsaPublicKey() { | ||
| ECDSAPublicKey ecdsaPublicKey = null; | ||
| if (x509Certificate != null) { |
| byte[] digest = null; | ||
| if (signatureAlgorithm != null) { | ||
| switch (signatureAlgorithm) { | ||
| case HS256: |
| if (signatureAlgorithm == SignatureAlgorithm.RS256 || signatureAlgorithm == SignatureAlgorithm.RS384 || signatureAlgorithm == SignatureAlgorithm.RS512) { | ||
| AlgorithmFamily algorithmFamily = signatureAlgorithm.getFamily(); | ||
|
|
||
| if(algorithmFamily == AlgorithmFamily.RSA) { |
moabu
changed the title
moabu
changed the title
|
[jans-cli] Kudos, SonarCloud Quality Gate passed!
|
|
[notify] Kudos, SonarCloud Quality Gate passed!
|
|
[jans-pycloudlib] Kudos, SonarCloud Quality Gate passed!
|
|
[orm] Kudos, SonarCloud Quality Gate passed!
|
|
[jans-core] Kudos, SonarCloud Quality Gate passed!
|
|
[jans-config-api-parent] Kudos, SonarCloud Quality Gate passed!
|
|
[Fido2 API] Kudos, SonarCloud Quality Gate passed!
|
|
[jans-client-api] Kudos, SonarCloud Quality Gate passed!
|
|
[SCIM API] Kudos, SonarCloud Quality Gate passed!
|
|
[Jans authentication server parent] Kudos, SonarCloud Quality Gate passed! |
No description provided.