Skip to content

Commit 05ad58f

Browse files
tloodutloodu
authored
Merge pull request #32693 from tloodu/remove-rsaOaep-FipsProfile
Remove RSA-OAEP filters and update tests to work with ECDH-ES JWEs
2 parents 0802c42 + 41632e3 commit 05ad58f

File tree

12 files changed

+698
-140
lines changed

12 files changed

+698
-140
lines changed

‎dev/com.ibm.ws.security.fat.common.jwt/src/com/ibm/ws/security/fat/common/jwt/utils/JwtTokenBuilderUtils.java‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -123,21 +123,22 @@ public void updateBuilderWithRSASettings(JWTTokenBuilder builder, String alg, St
123123
* @throws Exception
124124
*/
125125
public String buildAlternatePayloadJWEToken(Key key) throws Exception {
126-
JWTTokenBuilder builder = createAlternateJWEPayload(populateAlternateJWEToken(key));
127-
String jwtToken = builder.buildAlternateJWE();
128-
return jwtToken;
126+
return buildAlternatePayloadJWEToken(key, (String) null, (List<NameValuePair>) null);
129127
}
130128

131129
public String buildAlternatePayloadJWEToken(Key key, List<NameValuePair> extraPayload) throws Exception {
132-
JWTTokenBuilder builder = createAlternateJWEPayload(populateAlternateJWEToken(key), extraPayload);
133-
String jwtToken = builder.buildAlternateJWE();
134-
return jwtToken;
130+
return buildAlternatePayloadJWEToken(key, (String) null, extraPayload);
135131
}
136132

137133
public String buildAlternatePayloadJWEToken(Key key, String keyMgmtKeyAlg) throws Exception {
138-
JWTTokenBuilder builder = createAlternateJWEPayload(populateAlternateJWEToken(key, keyMgmtKeyAlg));
139-
String jwtToken = builder.buildAlternateJWE();
140-
return jwtToken;
134+
return buildAlternatePayloadJWEToken(key, keyMgmtKeyAlg, (List<NameValuePair>) null);
135+
}
136+
137+
public String buildAlternatePayloadJWEToken(Key key, String keyMgmtKeyAlg, List<NameValuePair> extraPayload) throws Exception {
138+
JWTTokenBuilder builder;
139+
builder = keyMgmtKeyAlg != null ? createAlternateJWEPayload(populateAlternateJWEToken(key, keyMgmtKeyAlg), extraPayload) : createAlternateJWEPayload(populateAlternateJWEToken(key), extraPayload);
140+
141+
return builder.buildAlternateJWE();
141142
}
142143

143144
/**

‎dev/com.ibm.ws.security.fat.common/publish/shared/securityKeys/allAlgKeyStore.p12‎

1002 Bytes
Binary file not shown.

‎dev/com.ibm.ws.security.fat.common/publish/shared/securityKeys/allAlgTrustStore.p12‎

640 Bytes
Binary file not shown.

‎dev/com.ibm.ws.security.oidc.client_fat.jaxrs/publish/servers/com.ibm.ws.security.openidconnect.client-1.0_fat.jaxrs.opWithStub/configs/op_server_encrypt.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,9 @@
111111
http://localhost:${bvt.prop.security_2_HTTP_default}/oidcclient/redirect/SignRS384Encryptnone,
112112
http://localhost:${bvt.prop.security_2_HTTP_default}/oidcclient/redirect/SignRS512Encryptnone,
113113
http://localhost:${bvt.prop.security_2_HTTP_default}/oidcclient/redirect/SignRS256EncryptShortRS256,
114+
http://localhost:${bvt.prop.security_2_HTTP_default}/oidcclient/redirect/SignES256EncryptShortES256,
114115
http://localhost:${bvt.prop.security_2_HTTP_default}/oidcclient/redirect/SignRS256EncryptPublicRS256,
116+
http://localhost:${bvt.prop.security_2_HTTP_default}/oidcclient/redirect/SignES256EncryptPublicES256,
115117
http://localhost:${bvt.prop.security_2_HTTP_default}/oidcclient/redirect/RP_trustStoreRefOmitted,
116118
http://localhost:${bvt.prop.security_2_HTTP_default}/oidcclient/redirect/RP_sslRefOmitted"
117119
scope="ALL_SCOPES"

‎dev/com.ibm.ws.security.oidc.server_fat.jaxrs.config.commonTest/fat/src/com/ibm/ws/security/openidconnect/server/fat/jaxrs/config/noOP/NoOPEncryptionRSServerTests.java‎

Lines changed: 262 additions & 39 deletions
Large diffs are not rendered by default.

‎dev/com.ibm.ws.security.oidc.server_fat.jaxrs.config.commonTest/publish/servers/com.ibm.ws.security.openidconnect.server-1.0_fat.jaxrs.config.RSserver/configs/server_encryption.xml‎

Lines changed: 117 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1738,6 +1738,33 @@
17381738
audiences="client01"
17391739
>
17401740
</openidConnectClient>
1741+
1742+
<authFilter id="authFilterES256ShortES256">
1743+
<requestUrl
1744+
id="requestUrlES256ShortES256"
1745+
urlPattern="/snoop/SignES256EncryptShortES256"
1746+
matchType="contains" />
1747+
</authFilter>
1748+
1749+
<openidConnectClient
1750+
id="SignES256EncryptShortES256"
1751+
scope="openid profile"
1752+
clientId="client01"
1753+
clientSecret="{xor}LDo8LTorbm1saw=="
1754+
mapIdentityToRegistryUser="true"
1755+
httpsRequired="false"
1756+
redirectToRPHostAndPort="http://localhost:${bvt.prop.security_3_HTTP_default}"
1757+
authFilterRef="authFilterES256ShortES256"
1758+
signatureAlgorithm="ES256"
1759+
trustStoreRef="trust_allSigAlg"
1760+
trustAliasName="es256"
1761+
keyManagementKeyAlias="short_es256"
1762+
sslRef="ssl_allSigAlg"
1763+
inboundPropagation="required"
1764+
issuerIdentifier="client01"
1765+
audiences="client01"
1766+
>
1767+
</openidConnectClient>
17411768

17421769
<authFilter id="authFilterRS256PublicRS256">
17431770
<requestUrl
@@ -1764,24 +1791,51 @@
17641791
issuerIdentifier="client01"
17651792
audiences="client01"
17661793
>
1767-
</openidConnectClient>
1794+
</openidConnectClient>
1795+
1796+
<authFilter id="authFilterES256PublicES256">
1797+
<requestUrl
1798+
id="requestUrlES256PublicES256"
1799+
urlPattern="/snoop/SignES256EncryptPublicES256"
1800+
matchType="contains" />
1801+
</authFilter>
1802+
1803+
<openidConnectClient
1804+
id="SignES256EncryptPublicES256"
1805+
scope="openid profile"
1806+
clientId="client01"
1807+
clientSecret="{xor}LDo8LTorbm1saw=="
1808+
mapIdentityToRegistryUser="true"
1809+
httpsRequired="false"
1810+
redirectToRPHostAndPort="http://localhost:${bvt.prop.security_3_HTTP_default}"
1811+
authFilterRef="authFilterES256PublicES256"
1812+
signatureAlgorithm="ES256"
1813+
trustStoreRef="trust_allSigAlg"
1814+
trustAliasName="es256"
1815+
keyManagementKeyAlias="es256"
1816+
sslRef="ssl_allSigAlg_badKeyStore"
1817+
inboundPropagation="required"
1818+
issuerIdentifier="client01"
1819+
audiences="client01"
1820+
>
1821+
</openidConnectClient>
17681822

1769-
<authFilter id="authFilterRS_trustStoreRefOmitted">
1823+
<authFilter id="authFilterRS_trustStoreRefOmitted_RSA_OAEP">
17701824
<requestUrl
1771-
id="requestUrlRS_trustStoreRefOmitted"
1772-
urlPattern="/snoop/RS_trustStoreRefOmitted"
1825+
id="requestUrlRS_trustStoreRefOmitted_RSA_OAEP"
1826+
urlPattern="/snoop/RS_trustStoreRefOmitted_RSA_OAEP"
17731827
matchType="contains" />
17741828
</authFilter>
17751829

17761830
<openidConnectClient
1777-
id="RS_trustStoreRefOmitted"
1831+
id="RS_trustStoreRefOmitted_RSA_OAEP"
17781832
scope="openid profile"
17791833
clientId="client01"
17801834
clientSecret="{xor}LDo8LTorbm1saw=="
17811835
mapIdentityToRegistryUser="true"
17821836
httpsRequired="false"
17831837
redirectToRPHostAndPort="http://localhost:${bvt.prop.security_3_HTTP_default}"
1784-
authFilterRef="authFilterRS_trustStoreRefOmitted"
1838+
authFilterRef="authFilterRS_trustStoreRefOmitted_RSA_OAEP"
17851839
signatureAlgorithm="RS256"
17861840
trustAliasName="rs256"
17871841
keyManagementKeyAlias="rs256"
@@ -1790,31 +1844,82 @@
17901844
issuerIdentifier="client01"
17911845
audiences="client01"
17921846
>
1793-
</openidConnectClient>
1847+
</openidConnectClient>
1848+
1849+
<authFilter id="authFilterRS_trustStoreRefOmitted_ECDH_ES">
1850+
<requestUrl
1851+
id="requestUrlRS_trustStoreRefOmitted_ECDH_ES"
1852+
urlPattern="/snoop/RS_trustStoreRefOmitted_ECDH_ES"
1853+
matchType="contains" />
1854+
</authFilter>
1855+
1856+
<openidConnectClient
1857+
id="RS_trustStoreRefOmitted_ECDH_ES"
1858+
scope="openid profile"
1859+
clientId="client01"
1860+
clientSecret="{xor}LDo8LTorbm1saw=="
1861+
mapIdentityToRegistryUser="true"
1862+
httpsRequired="false"
1863+
redirectToRPHostAndPort="http://localhost:${bvt.prop.security_3_HTTP_default}"
1864+
authFilterRef="authFilterRS_trustStoreRefOmitted_ECDH_ES"
1865+
signatureAlgorithm="ES256"
1866+
trustAliasName="es256"
1867+
keyManagementKeyAlias="es256"
1868+
sslRef="ssl_allSigAlg"
1869+
inboundPropagation="required"
1870+
issuerIdentifier="client01"
1871+
audiences="client01"
1872+
>
1873+
</openidConnectClient>
17941874

1795-
<authFilter id="authFilterRS_sslRefOmitted">
1875+
<authFilter id="authFilterRS_sslRefOmitted_RSA_OAEP">
17961876
<requestUrl
1797-
id="requestUrlRS_sslRefOmitted"
1798-
urlPattern="/snoop/RS_sslRefOmitted"
1877+
id="requestUrlRS_sslRefOmitted_RSA_OAEP"
1878+
urlPattern="/snoop/RS_sslRefOmitted_RSA_OAEP"
17991879
matchType="contains" />
18001880
</authFilter>
18011881

18021882
<openidConnectClient
1803-
id="RS_sslRefOmitted"
1883+
id="RS_sslRefOmitted_RSA_OAEP"
18041884
scope="openid profile"
18051885
clientId="client01"
18061886
clientSecret="{xor}LDo8LTorbm1saw=="
18071887
mapIdentityToRegistryUser="true"
18081888
httpsRequired="false"
18091889
redirectToRPHostAndPort="http://localhost:${bvt.prop.security_3_HTTP_default}"
1810-
authFilterRef="authFilterRS_sslRefOmitted"
1890+
authFilterRef="authFilterRS_sslRefOmitted_RSA_OAEP"
18111891
signatureAlgorithm="RS256"
18121892
trustAliasName="rs256"
18131893
keyManagementKeyAlias="rs256"
18141894
inboundPropagation="required"
18151895
issuerIdentifier="client01"
18161896
audiences="client01"
18171897
>
1898+
</openidConnectClient>
1899+
1900+
<authFilter id="authFilterRS_sslRefOmitted_ECDH_ES">
1901+
<requestUrl
1902+
id="requestUrlRS_sslRefOmitted_ECDH_ES"
1903+
urlPattern="/snoop/RS_sslRefOmitted_ECDH_ES"
1904+
matchType="contains" />
1905+
</authFilter>
1906+
1907+
<openidConnectClient
1908+
id="RS_sslRefOmitted_ECDH_ES"
1909+
scope="openid profile"
1910+
clientId="client01"
1911+
clientSecret="{xor}LDo8LTorbm1saw=="
1912+
mapIdentityToRegistryUser="true"
1913+
httpsRequired="false"
1914+
redirectToRPHostAndPort="http://localhost:${bvt.prop.security_3_HTTP_default}"
1915+
authFilterRef="authFilterRS_sslRefOmitted_ECDH_ES"
1916+
signatureAlgorithm="ES256"
1917+
trustAliasName="es256"
1918+
keyManagementKeyAlias="es256"
1919+
inboundPropagation="required"
1920+
issuerIdentifier="client01"
1921+
audiences="client01"
1922+
>
18181923
</openidConnectClient>
18191924

18201925
</server>

‎dev/com.ibm.ws.security.oidc.server_fat.jaxrs.config.noOP/semeruFips140_3CustomProfile.properties‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎dev/com.ibm.ws.security.social_fat.LibertyOP.2/semeruFips140_3CustomProfile.properties‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎dev/com.ibm.ws.security.social_fat.commonTest.LibertyOP/fat/src/com/ibm/ws/security/social/fat/LibertyOP/LibertyOP_Encryption_oidc_usingSocialConfig.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
import org.junit.BeforeClass;
2020
import org.junit.ClassRule;
21+
import org.junit.Rule;
2122
import org.junit.runner.RunWith;
2223

2324
import com.ibm.ws.security.oauth_oidc.fat.commonTest.Constants;
@@ -31,6 +32,8 @@
3132
import componenttest.custom.junit.runner.Mode;
3233
import componenttest.custom.junit.runner.Mode.TestMode;
3334
import componenttest.rules.repeater.RepeatTests;
35+
import componenttest.rules.SkipJavaSemeruWithFipsEnabled;
36+
import componenttest.rules.SkipJavaSemeruWithFipsEnabled.SkipJavaSemeruWithFipsEnabledRule;
3437
import componenttest.topology.impl.LibertyServerWrapper;
3538

3639
@RunWith(FATRunner.class)
@@ -45,6 +48,9 @@ public class LibertyOP_Encryption_oidc_usingSocialConfig extends Social_Encrypti
4548
@ClassRule
4649
public static RepeatTests r = RepeatTests.withoutModification();
4750

51+
@Rule
52+
public static final SkipJavaSemeruWithFipsEnabled skipJavaSemeruWithFipsEnabled = new SkipJavaSemeruWithFipsEnabled(SocialConstants.SERVER_NAME + ".LibertyOP.opWithStub");
53+
4854
@BeforeClass
4955
public static void setUp() throws Exception {
5056

‎dev/com.ibm.ws.security.social_fat.commonTest.LibertyOP/publish/files/serversettings/oidcSigningEncryptingProvider.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,9 @@
104104
https://localhost:${bvt.prop.security_2_HTTP_default.secure}/ibm/api/social-login/redirect/SignES384Encryptnone,
105105
https://localhost:${bvt.prop.security_2_HTTP_default.secure}/ibm/api/social-login/redirect/SignES512Encryptnone,
106106
https://localhost:${bvt.prop.security_2_HTTP_default.secure}/ibm/api/social-login/redirect/SignRS256EncryptShortRS256,
107+
https://localhost:${bvt.prop.security_2_HTTP_default.secure}/ibm/api/social-login/redirect/SignES256EncryptShortES256,
107108
https://localhost:${bvt.prop.security_2_HTTP_default.secure}/ibm/api/social-login/redirect/SignRS256EncryptPublicRS256,
109+
https://localhost:${bvt.prop.security_2_HTTP_default.secure}/ibm/api/social-login/redirect/SignES256EncryptPublicES256,
108110
https://localhost:${bvt.prop.security_2_HTTP_default.secure}/ibm/api/social-login/redirect/RP_trustStoreRefOmitted,
109111
https://localhost:${bvt.prop.security_2_HTTP_default.secure}/ibm/api/social-login/redirect/RP_sslRefOmitted"
110112
scope="ALL_SCOPES"

0 commit comments

Comments
 (0)