Skip to content

Commit

Permalink
review
Browse files Browse the repository at this point in the history
  • Loading branch information
@strehle
strehle committed May 3, 2023
1 parent 1714e1f commit 31fd4e7
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 26 deletions.
37 changes: 14 additions & 23 deletions server/src/main/java/org/cloudfoundry/identity/uaa/oauth/KeyInfo.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@
import static org.cloudfoundry.identity.uaa.oauth.jwk.JsonWebKey.KeyType.RSA;

public class KeyInfo {
private final boolean isAsymetric;
private final boolean isAsymmetric;
private Signer signer;
private SignatureVerifier verifier;
private final String keyId;
Expand All @@ -54,23 +54,23 @@ public KeyInfo(String keyId, String signingKey, String keyUrl) {
public KeyInfo(String keyId, String signingKey, String keyUrl, String sigAlg, String signingCert) {
this.keyId = keyId;
this.keyUrl = validateAndConstructTokenKeyUrl(keyUrl);
this.isAsymetric = isAssymetricKey(signingKey);
this.isAsymmetric = isAsymmetric(signingKey);
String algorithm;
if (this.isAsymetric) {
if (this.isAsymmetric) {
String jwtAlg;
KeyPair keyPair;
try {
jwk = JWK.parseFromPEMEncodedObjects(signingKey);
jwtAlg = jwk.getKeyType().getValue();
if (jwtAlg.startsWith("RSA")) {
algorithm = Optional.ofNullable(sigAlg).map(JwtAlgorithms::sigAlgJava).orElse("SHA256withRSA");
algorithm = Optional.ofNullable(sigAlg).map(JwtAlgorithms::sigAlgJava).orElse(JwtAlgorithms.DEFAULT_RSA);
keyPair = jwk.toRSAKey().toKeyPair();
PublicKey rsaPublicKey = keyPair.getPublic();
this.signer = new RsaSigner((RSAPrivateKey) keyPair.getPrivate(), algorithm);
this.verifier = new RsaVerifier((RSAPublicKey) rsaPublicKey, algorithm);
this.type = RSA;
} else if (jwtAlg.startsWith("EC")) {
algorithm = Optional.ofNullable(sigAlg).map(JwtAlgorithms::sigAlgJava).orElse("SHA256withECDSA");
algorithm = Optional.ofNullable(sigAlg).map(JwtAlgorithms::sigAlgJava).orElse(JwtAlgorithms.DEFAULT_EC);
keyPair = jwk.toECKey().toKeyPair();
this.signer = null;
this.verifier = new EllipticCurveVerifier((ECPublicKey) keyPair.getPublic(), algorithm);
Expand All @@ -85,7 +85,7 @@ public KeyInfo(String keyId, String signingKey, String keyUrl, String sigAlg, St
this.verifierKey = JsonWebKey.pemEncodePublicKey(keyPair.getPublic()).orElse(null);
} else {
jwk = new OctetSequenceKey.Builder(signingKey.getBytes()).build();
algorithm = Optional.ofNullable(sigAlg).map(JwtAlgorithms::sigAlgJava).orElse("HMACSHA256");
algorithm = Optional.ofNullable(sigAlg).map(JwtAlgorithms::sigAlgJava).orElse(JwtAlgorithms.DEFAULT_HMAC);
SecretKey hmacKey = new SecretKeySpec(signingKey.getBytes(), algorithm);
this.signer = new MacSigner(algorithm, hmacKey);
this.verifier = new MacSigner(algorithm, hmacKey);
Expand All @@ -94,9 +94,6 @@ public KeyInfo(String keyId, String signingKey, String keyUrl, String sigAlg, St
this.type = MAC;
}
}
public void verify() {
// not in use
}

public SignatureVerifier getVerifier() {
return this.verifier;
Expand Down Expand Up @@ -127,13 +124,13 @@ public Optional<String> verifierCertificate() {
}

public Map<String, Object> getJwkMap() {
if (this.isAsymetric) {
Map<String, Object> result = new HashMap<>();
result.put(HeaderParameterNames.ALGORITHM, this.algorithm());
//new values per OpenID and JWK spec
result.put(JWKParameterNames.PUBLIC_KEY_USE, JsonWebKey.KeyUse.sig.name());
result.put(HeaderParameterNames.KEY_ID, this.keyId);
result.put(JWKParameterNames.KEY_TYPE, type.name());
Map<String, Object> result = new HashMap<>();
result.put(HeaderParameterNames.ALGORITHM, this.algorithm());
//new values per OpenID and JWK spec
result.put(JWKParameterNames.PUBLIC_KEY_USE, JsonWebKey.KeyUse.sig.name());
result.put(HeaderParameterNames.KEY_ID, this.keyId);
result.put(JWKParameterNames.KEY_TYPE, type.name());
if (this.isAsymmetric) {
// X509 releated values from JWK spec
if (this.verifierCertificate.isPresent()) {
X509Certificate x509Certificate = X509CertUtils.parse(verifierCertificate.get());
Expand Down Expand Up @@ -161,13 +158,7 @@ public Map<String, Object> getJwkMap() {
}
return result;
} else {
Map<String, Object> result = new HashMap<>();
result.put(HeaderParameterNames.ALGORITHM, this.algorithm());
result.put(JsonWebKey.PUBLIC_KEY_VALUE, this.verifierKey);
//new values per OpenID and JWK spec
result.put(JWKParameterNames.PUBLIC_KEY_USE, JsonWebKey.KeyUse.sig.name());
result.put(HeaderParameterNames.KEY_ID, this.keyId);
result.put(JWKParameterNames.KEY_TYPE, type.name());
return result;
}
}
Expand All @@ -184,7 +175,7 @@ private static String validateAndConstructTokenKeyUrl(String keyUrl) {
return UriComponentsBuilder.fromHttpUrl(keyUrl).scheme("https").path("/token_keys").build().toUriString();
}

private static boolean isAssymetricKey(String key) {
private static boolean isAsymmetric(String key) {
return key.startsWith("-----BEGIN");
}
}
9 changes: 6 additions & 3 deletions server/src/main/java/org/cloudfoundry/identity/uaa/oauth/jwt/JwtAlgorithms.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,22 +21,25 @@
* @author Luke Taylor
*/
public class JwtAlgorithms {
public static final String DEFAULT_HMAC = "HMACSHA256";
public static final String DEFAULT_EC = "SHA256withECDSA";
public static final String DEFAULT_RSA = "SHA256withRSA";
private static final Map<String,String> sigAlgs = new HashMap<String,String>();
private static final Map<String,String> javaToSigAlgs = new HashMap<String,String>();
private static final Map<String,String> keyAlgs = new HashMap<String,String>();
private static final Map<String,String> javaToKeyAlgs = new HashMap<String,String>();

static {
sigAlgs.put("HS256", "HMACSHA256");
sigAlgs.put("HS256", DEFAULT_HMAC);
sigAlgs.put("HS384" , "HMACSHA384");
sigAlgs.put("HS512" , "HMACSHA512");
sigAlgs.put("RS256" , "SHA256withRSA");
sigAlgs.put("RS256" , DEFAULT_RSA);
sigAlgs.put("RS384" , "SHA384withRSA");
sigAlgs.put("RS512" , "SHA512withRSA");
sigAlgs.put("PS256" , "SHA256withRSAandMGF1");
sigAlgs.put("PS384" , "SHA384withRSAandMGF1");
sigAlgs.put("PS512" , "SHA512withRSAandMGF1");
sigAlgs.put("ES256" , "SHA256withECDSA");
sigAlgs.put("ES256" , DEFAULT_EC);
sigAlgs.put("ES256K" , "SHA256withECDSA");
sigAlgs.put("ES384" , "SHA384withECDSA");
sigAlgs.put("ES512" , "SHA512withECDSA");
Expand Down

0 comments on commit 31fd4e7

Please sign in to comment.