-
Notifications
You must be signed in to change notification settings - Fork 20
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add JWT verification and extend tests
- Loading branch information
1 parent
ce75056
commit 5ae223d
Showing
6 changed files
with
245 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
71 changes: 71 additions & 0 deletions
71
src/main/java/org/eclipse/tractusx/managedidentitywallets/utils/CompositDidResolver.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| /* | ||
| * ******************************************************************************* | ||
| * Copyright (c) 2021,2024 Contributors to the Eclipse Foundation | ||
| * | ||
| * See the NOTICE file(s) distributed with this work for additional | ||
| * information regarding copyright ownership. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0. | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations | ||
| * under the License. | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * ****************************************************************************** | ||
| */ | ||
|
|
||
| package org.eclipse.tractusx.managedidentitywallets.utils; | ||
|
|
||
| import org.eclipse.tractusx.ssi.lib.did.resolver.DidResolver; | ||
| import org.eclipse.tractusx.ssi.lib.did.resolver.DidResolverException; | ||
| import org.eclipse.tractusx.ssi.lib.model.did.Did; | ||
| import org.eclipse.tractusx.ssi.lib.model.did.DidDocument; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| import java.util.Arrays; | ||
|
|
||
| @Component | ||
| public class CompositDidResolver implements DidResolver { | ||
| DidResolver[] didResolvers; | ||
|
|
||
| public CompositDidResolver(DidResolver... didResolvers) { | ||
| this.didResolvers = didResolvers; | ||
| } | ||
|
|
||
| public DidDocument resolve(Did did) throws DidResolverException { | ||
| DidResolver[] var2 = this.didResolvers; | ||
| int var3 = var2.length; | ||
|
|
||
| for(int var4 = 0; var4 < var3; ++var4) { | ||
| DidResolver didResolver = var2[var4]; | ||
| if (didResolver.isResolvable(did)) { | ||
| try { | ||
| DidDocument result = didResolver.resolve(did); | ||
| if (result != null) { | ||
| return result; | ||
| } | ||
| } catch (DidResolverException var7) { | ||
| throw var7; | ||
| } catch (Throwable var8) { | ||
| throw new DidResolverException(String.format("Unrecognized exception: %s", var8.getClass().getName()), var8); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| return null; | ||
| } | ||
|
|
||
| public boolean isResolvable(Did did) { | ||
| return Arrays.stream(this.didResolvers).anyMatch((resolver) -> resolver.isResolvable(did)); | ||
| } | ||
|
|
||
| public static org.eclipse.tractusx.ssi.lib.did.resolver.CompositeDidResolver append(DidResolver target, DidResolver toBeAppended) { | ||
| return new org.eclipse.tractusx.ssi.lib.did.resolver.CompositeDidResolver(target, toBeAppended); | ||
| } | ||
| } | ||
|
|
96 changes: 96 additions & 0 deletions
96
src/main/java/org/eclipse/tractusx/managedidentitywallets/utils/CustomSignedJWTVerifier.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| /* | ||
| * ******************************************************************************* | ||
| * Copyright (c) 2021,2024 Contributors to the Eclipse Foundation | ||
| * | ||
| * See the NOTICE file(s) distributed with this work for additional | ||
| * information regarding copyright ownership. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0. | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations | ||
| * under the License. | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * ****************************************************************************** | ||
| */ | ||
|
|
||
| package org.eclipse.tractusx.managedidentitywallets.utils; | ||
|
|
||
| import com.nimbusds.jose.JOSEException; | ||
| import com.nimbusds.jose.crypto.Ed25519Verifier; | ||
| import com.nimbusds.jose.jwk.Curve; | ||
| import com.nimbusds.jose.jwk.OctetKeyPair; | ||
| import com.nimbusds.jose.util.Base64URL; | ||
| import com.nimbusds.jwt.SignedJWT; | ||
| import lombok.Data; | ||
| import lombok.RequiredArgsConstructor; | ||
| import org.bouncycastle.crypto.params.Ed25519PublicKeyParameters; | ||
| import org.eclipse.tractusx.managedidentitywallets.exception.BadDataException; | ||
| import org.eclipse.tractusx.managedidentitywallets.service.DidDocumentService; | ||
| import org.eclipse.tractusx.ssi.lib.did.resolver.DidResolver; | ||
| import org.eclipse.tractusx.ssi.lib.exception.UnsupportedVerificationMethodException; | ||
| import org.eclipse.tractusx.ssi.lib.model.MultibaseString; | ||
| import org.eclipse.tractusx.ssi.lib.model.did.DidDocument; | ||
| import org.eclipse.tractusx.ssi.lib.model.did.Ed25519VerificationMethod; | ||
| import org.eclipse.tractusx.ssi.lib.model.did.JWKVerificationMethod; | ||
| import org.eclipse.tractusx.ssi.lib.model.did.VerificationMethod; | ||
| import org.springframework.stereotype.Service; | ||
|
|
||
| import java.util.Map; | ||
|
|
||
| @Service | ||
| @RequiredArgsConstructor | ||
| @Data | ||
| public class CustomSignedJWTVerifier { | ||
| private DidResolver didResolver; | ||
| private final DidDocumentService didDocumentService; | ||
| public static final String KID = "kid"; | ||
|
|
||
| public boolean verify(String did, SignedJWT jwt) throws JOSEException { | ||
| try { | ||
| VerificationMethod verificationMethod = checkVerificationMethod(did, jwt); | ||
| if (JWKVerificationMethod.isInstance(verificationMethod)) { | ||
| JWKVerificationMethod method = new JWKVerificationMethod(verificationMethod); | ||
| String kty = method.getPublicKeyJwk().getKty(); | ||
| String crv = method.getPublicKeyJwk().getCrv(); | ||
| String x = method.getPublicKeyJwk().getX(); | ||
| if (!kty.equals("OKP") || !crv.equals("Ed25519")) { | ||
| throw new UnsupportedVerificationMethodException(method, "only kty:OKP with crv:Ed25519 is supported"); | ||
| } | ||
|
|
||
| OctetKeyPair keyPair = (new OctetKeyPair.Builder(Curve.Ed25519, Base64URL.from(x))).build(); | ||
| if (jwt.verify(new Ed25519Verifier(keyPair))) { | ||
| return true; | ||
| } | ||
| } else if (Ed25519VerificationMethod.isInstance(verificationMethod)) { | ||
| Ed25519VerificationMethod method = new Ed25519VerificationMethod(verificationMethod); | ||
| MultibaseString multibase = method.getPublicKeyBase58(); | ||
| Ed25519PublicKeyParameters publicKeyParameters = new Ed25519PublicKeyParameters(multibase.getDecoded(), 0); | ||
| OctetKeyPair keyPair = (new OctetKeyPair.Builder(Curve.Ed25519, Base64URL.encode(publicKeyParameters.getEncoded()))).build(); | ||
| if (jwt.verify(new Ed25519Verifier(keyPair))) { | ||
| return true; | ||
| } | ||
| } | ||
| } catch (JOSEException var15) { | ||
| throw var15; | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| public VerificationMethod checkVerificationMethod(String did, SignedJWT jwt) { | ||
| Map<String, Object> headers = jwt.getHeader().toJSONObject(); | ||
| String kid = String.valueOf(headers.get(KID)); | ||
| DidDocument didDocument = didDocumentService.getDidDocument(did); | ||
| for (VerificationMethod method : didDocument.getVerificationMethods()) { | ||
| if (method.getId().toString().contains(kid)) { | ||
| return method; | ||
| } | ||
| } | ||
| throw new BadDataException("Verification method doesn't match 'kid' parameter"); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters