Skip to content

Commit 15a7927

Browse files
darranldarranl
committed
Sync from 2.2.x
2 parents af17cc5 + 478026b commit 15a7927

File tree

12 files changed

+398
-71
lines changed

12 files changed

+398
-71
lines changed

‎auth/client/src/main/java/org/wildfly/security/auth/client/WildFlyElytronClientDefaultSSLContextProvider.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,9 @@ public Object newInstance(Object ignored) throws NoSuchAlgorithmException {
126126
throw ElytronMessages.log.sslContextForSecurityProviderCreatesInfiniteLoop();
127127
}
128128
} catch (ConfigXMLParseException | GeneralSecurityException e) {
129+
if (log.isTraceEnabled()) {
130+
log.trace("Unable to obtain SSLContext", e);
131+
}
129132
if (e.getCause() instanceof FileNotFoundException) {
130133
throw log.clientConfigurationFileNotFound();
131134
}

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/JWKEncPublicKeyLocator.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,16 +21,16 @@
2121
import static org.apache.http.HttpHeaders.ACCEPT;
2222
import static org.wildfly.security.http.oidc.ElytronMessages.log;
2323
import static org.wildfly.security.http.oidc.Oidc.JSON_CONTENT_TYPE;
24+
import static org.wildfly.security.jose.jwk.JsonWebKeySetUtil.FOR_ENCRYPTION;
25+
import static org.wildfly.security.jose.jwk.JsonWebKeySetUtil.getKeys;
2426

2527
import java.security.PublicKey;
2628
import java.util.ArrayList;
2729
import java.util.Map;
2830
import java.util.List;
2931

3032
import org.apache.http.client.methods.HttpGet;
31-
import org.wildfly.security.jose.jwk.JWK;
3233
import org.wildfly.security.jose.jwk.JsonWebKeySet;
33-
import org.wildfly.security.jose.jwk.JsonWebKeySetUtil;
3434

3535
/**
3636
* A public key locator that dynamically obtains the public key used for encryption
@@ -97,7 +97,7 @@ private void sendRequest(OidcClientConfiguration config) {
9797
request.addHeader(ACCEPT, JSON_CONTENT_TYPE);
9898
try {
9999
JsonWebKeySet jwks = Oidc.sendJsonHttpRequest(config, request, JsonWebKeySet.class);
100-
Map<String, PublicKey> publicKeys = JsonWebKeySetUtil.getKeysForUse(jwks, JWK.Use.ENC);
100+
Map<String, PublicKey> publicKeys = getKeys(jwks, FOR_ENCRYPTION);
101101

102102
if (log.isDebugEnabled()) {
103103
log.debug("Public keys successfully retrieved for client " + config.getResourceName() + ". New kids: " + publicKeys.keySet());

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/JWKPublicKeyLocator.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,15 @@
1919
package org.wildfly.security.http.oidc;
2020

2121
import static org.wildfly.security.http.oidc.ElytronMessages.log;
22+
import static org.wildfly.security.jose.jwk.JsonWebKeySetUtil.FOR_SIGNATURE_VALIDATION;
23+
import static org.wildfly.security.jose.jwk.JsonWebKeySetUtil.getKeys;
2224

2325
import java.security.PublicKey;
2426
import java.util.Map;
2527
import java.util.concurrent.ConcurrentHashMap;
2628

2729
import org.apache.http.client.methods.HttpGet;
28-
import org.wildfly.security.jose.jwk.JWK;
2930
import org.wildfly.security.jose.jwk.JsonWebKeySet;
30-
import org.wildfly.security.jose.jwk.JsonWebKeySetUtil;
3131

3232
/**
3333
* A public key locator that dynamically obtains the public key from an OpenID
@@ -95,7 +95,7 @@ private void sendRequest(OidcClientConfiguration oidcClientConfiguration) {
9595
try {
9696
JsonWebKeySet jwks = Oidc.sendJsonHttpRequest(oidcClientConfiguration, getMethod, JsonWebKeySet.class);
9797

98-
Map<String, PublicKey> publicKeys = JsonWebKeySetUtil.getKeysForUse(jwks, JWK.Use.SIG);
98+
Map<String, PublicKey> publicKeys = getKeys(jwks, FOR_SIGNATURE_VALIDATION);
9999

100100
if (log.isDebugEnabled()) {
101101
log.debug("Public keys successfully retrieved for client " + oidcClientConfiguration.getResourceName() + ". New kids: " + publicKeys.keySet().toString());

‎jose/jwk/pom.xml

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
<groupId>org.jboss.logging</groupId>
5353
<artifactId>jboss-logging</artifactId>
5454
<scope>provided</scope>
55-
</dependency>
55+
</dependency>
5656
<dependency>
5757
<groupId>org.jboss.logging</groupId>
5858
<artifactId>jboss-logging-processor</artifactId>
@@ -67,7 +67,45 @@
6767
<groupId>com.fasterxml.jackson.core</groupId>
6868
<artifactId>jackson-annotations</artifactId>
6969
</dependency>
70-
70+
71+
<!-- Test Scope -->
72+
<dependency>
73+
<groupId>junit</groupId>
74+
<artifactId>junit</artifactId>
75+
<scope>test</scope>
76+
</dependency>
77+
<dependency>
78+
<groupId>net.minidev</groupId>
79+
<artifactId>json-smart</artifactId>
80+
<scope>test</scope>
81+
</dependency>
82+
<dependency>
83+
<groupId>com.nimbusds</groupId>
84+
<artifactId>nimbus-jose-jwt</artifactId>
85+
<scope>test</scope>
86+
<exclusions>
87+
<exclusion>
88+
<groupId>net.minidev</groupId>
89+
<artifactId>json-smart</artifactId>
90+
</exclusion>
91+
</exclusions>
92+
</dependency>
93+
<dependency>
94+
<groupId>jakarta.json</groupId>
95+
<artifactId>jakarta.json-api</artifactId>
96+
<scope>test</scope>
97+
</dependency>
98+
<dependency>
99+
<groupId>org.eclipse.parsson</groupId>
100+
<artifactId>jakarta.json</artifactId>
101+
<scope>test</scope>
102+
</dependency>
103+
<dependency>
104+
<groupId>org.wildfly.security</groupId>
105+
<artifactId>wildfly-elytron-tests-common</artifactId>
106+
<type>test-jar</type>
107+
<scope>test</scope>
108+
</dependency>
71109
</dependencies>
72110

73111
</project>

‎jose/jwk/src/main/java/org/wildfly/security/jose/jwk/JWK.java

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ public class JWK {
4242

4343
public static final String PUBLIC_KEY_USE = "use";
4444

45+
public static final String KEY_OPS = "key_ops";
46+
4547
public enum Use {
4648
SIG("sig"),
4749
ENC("enc");
@@ -57,6 +59,27 @@ public String asString() {
5759
}
5860
}
5961

62+
public enum KeyOp {
63+
SIGN("sign"),
64+
VERIFY("verify"),
65+
ENCRYPT("encrypt"),
66+
DECRYPT("decrypt"),
67+
WRAP_KEY("wrapKey"),
68+
UNWRAP_KEY("unwrapKey"),
69+
DERIVE_KEY("deriveKey"),
70+
DERIVE_BITS("deriveBits");
71+
72+
private String str;
73+
74+
KeyOp(String str) {
75+
this.str = str;
76+
}
77+
78+
public String asString() {
79+
return str;
80+
}
81+
}
82+
6083
@JsonProperty(KEY_ID)
6184
private String keyId;
6285

@@ -69,6 +92,9 @@ public String asString() {
6992
@JsonProperty(PUBLIC_KEY_USE)
7093
private String publicKeyUse;
7194

95+
@JsonProperty(KEY_OPS)
96+
private String[] keyOps;
97+
7298
protected Map<String, Object> otherClaims = new HashMap<String, Object>();
7399

74100

@@ -104,6 +130,14 @@ public void setPublicKeyUse(String publicKeyUse) {
104130
this.publicKeyUse = publicKeyUse;
105131
}
106132

133+
public String[] getKeyOps() {
134+
return keyOps;
135+
}
136+
137+
public void setKeyOps(String[] keyOps) {
138+
this.keyOps = keyOps;
139+
}
140+
107141
@JsonAnyGetter
108142
public Map<String, Object> getOtherClaims() {
109143
return otherClaims;

‎jose/jwk/src/main/java/org/wildfly/security/jose/jwk/JWKParser.java

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -74,21 +74,25 @@ public JWK getJwk() {
7474
}
7575

7676
public PublicKey toPublicKey() {
77+
return toPublicKey(jwk);
78+
}
79+
80+
public static PublicKey toPublicKey(JWK jwk) {
7781
String keyType = jwk.getKeyType();
7882
if (keyType.equals(RSAPublicJWK.RSA)) {
79-
return createRSAPublicKey();
83+
return createRSAPublicKey(jwk);
8084
} else if (keyType.equals(ECPublicJWK.EC)) {
81-
return createECPublicKey();
85+
return createECPublicKey(jwk);
8286
} else {
8387
throw log.unsupportedKeyTypeForJWK(keyType);
8488
}
8589
}
8690

87-
public boolean isKeyTypeSupported(String keyType) {
91+
public static boolean isKeyTypeSupported(String keyType) {
8892
return (RSAPublicJWK.RSA.equals(keyType) || ECPublicJWK.EC.equals(keyType));
8993
}
9094

91-
private PublicKey createECPublicKey() {
95+
private static PublicKey createECPublicKey(JWK jwk) {
9296
String crv = (String) jwk.getOtherClaims().get(ECPublicJWK.CRV);
9397

9498
BigInteger x = new BigInteger(1,
@@ -123,7 +127,7 @@ private PublicKey createECPublicKey() {
123127
}
124128
}
125129

126-
private PublicKey createRSAPublicKey() {
130+
private static PublicKey createRSAPublicKey(JWK jwk) {
127131
BigInteger modulus = new BigInteger(1,
128132
CodePointIterator.ofString(jwk.getOtherClaims().get(RSAPublicJWK.MODULUS).toString()).base64Decode(BASE64_URL, false).drain());
129133
BigInteger publicExponent = new BigInteger(1,

‎jose/jwk/src/main/java/org/wildfly/security/jose/jwk/JsonWebKeySetUtil.java

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,13 @@
1818

1919
package org.wildfly.security.jose.jwk;
2020

21+
import static org.wildfly.security.jose.jwk.JWKParser.isKeyTypeSupported;
22+
import static org.wildfly.security.jose.jwk.JWKParser.toPublicKey;
23+
2124
import java.security.PublicKey;
2225
import java.util.HashMap;
2326
import java.util.Map;
27+
import java.util.function.Predicate;
2428

2529
/**
2630
* Utility methods for JSON Web Key Sets.
@@ -31,15 +35,44 @@
3135
*/
3236
public class JsonWebKeySetUtil {
3337

34-
public static Map<String, PublicKey> getKeysForUse(JsonWebKeySet keySet, JWK.Use requestedUse) {
38+
public static Map<String, PublicKey> getKeys(JsonWebKeySet keySet, Predicate<JWK> keyPredicate) {
3539
Map<String, PublicKey> result = new HashMap<>();
3640
for (JWK jwk : keySet.getKeys()) {
37-
JWKParser parser = JWKParser.create(jwk);
38-
if (jwk.getPublicKeyUse().equals(requestedUse.asString()) && parser.isKeyTypeSupported(jwk.getKeyType())) {
39-
result.put(jwk.getKeyId(), parser.toPublicKey());
41+
if (keyPredicate.test(jwk)) {
42+
result.put(jwk.getKeyId(), toPublicKey(jwk));
4043
}
4144
}
4245
return result;
4346
}
4447

48+
/*
49+
* Key Filtering Predicates.
50+
*/
51+
52+
public static Predicate<JWK> SUPPORTED_KEY_TYPE = j -> isKeyTypeSupported(j.getKeyType());
53+
54+
public static Predicate<JWK> usePredicate(JWK.Use requestedUse) {
55+
return j -> j.getPublicKeyUse() != null && j.getPublicKeyUse().equals(requestedUse.asString());
56+
}
57+
58+
public static Predicate<JWK> keyOpsPredicate(JWK.KeyOp requestedKeyOp) {
59+
return j -> {
60+
String[] keyOps = j.getKeyOps();
61+
if (keyOps != null) {
62+
for (String keyOp : keyOps) {
63+
if (keyOp.equals(requestedKeyOp.asString())) {
64+
return true;
65+
}
66+
}
67+
}
68+
69+
return false;
70+
};
71+
}
72+
73+
public static Predicate<JWK> FOR_SIGNATURE_VALIDATION = SUPPORTED_KEY_TYPE.and(
74+
usePredicate(JWK.Use.SIG).or(keyOpsPredicate(JWK.KeyOp.VERIFY)));
75+
76+
public static Predicate<JWK> FOR_ENCRYPTION = SUPPORTED_KEY_TYPE.and(
77+
usePredicate(JWK.Use.ENC).or(keyOpsPredicate(JWK.KeyOp.ENCRYPT)));
4578
}

0 commit comments

Comments
 (0)