Skip to content

Commit 35b2301

Browse files
jalaurosjalauros
committed
toJwt method signature changed, tests for ECDH
1 parent 17f4f9f commit 35b2301

5 files changed

Lines changed: 99 additions & 49 deletions

File tree

‎src/main/java/org/oidc/msg/AbstractMessage.java‎

Lines changed: 9 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -396,8 +396,7 @@ private String parseFromToken(String token, KeyJar keyJar, String keyOwner, Stri
396396
try {
397397
decyptionAlg = AlgorithmResolver.resolveKeyTransportAlgorithmForDecryption(key,
398398
decodedJwt);
399-
} catch (ValueError | UnsupportedEncodingException | SerializationNotPossible
400-
| DeserializationNotPossible e) {
399+
} catch (ValueError | UnsupportedEncodingException | SerializationNotPossible e) {
401400
if (iter.hasNext()) {
402401
// We move on to try next key
403402
continue;
@@ -424,19 +423,6 @@ private String parseFromToken(String token, KeyJar keyJar, String keyOwner, Stri
424423
}
425424

426425

427-
/**
428-
* Serialize the content of this instance (the claims map) into a jwt string.
429-
*
430-
* @param signingKey
431-
* signing key
432-
* @param alg
433-
* signing algorithm name
434-
* @return message as jwt string.
435-
* @throws SerializationException
436-
*/
437-
public String toJwt(Key signingKey, String alg) throws SerializationException {
438-
return toJwt(signingKey, alg, null, null, null);
439-
}
440426
/**
441427
* Serialize the content of this instance (the claims map) into a jwt string.
442428
*
@@ -450,10 +436,16 @@ public String toJwt(Key signingKey, String alg) throws SerializationException {
450436
* key transport algorithm name. Must not be null if transportKey is set.
451437
* @param encEnc
452438
* content encryption algorithm name. Must not be null if transportKey is set.
439+
* @param keyjar
440+
* key jar containing receiver ephemeral public key when using ECDH family of key transport
441+
* @param sender
442+
* sender i.e. client id
443+
* @param receiver
444+
* receiver i.e. issuer id of the o.
453445
* @return message as jwt string.
454446
*/
455447

456-
public String toJwt(Key signingKey, String alg, Key transportKey, String encAlg, String encEnc)
448+
public String toJwt(Key signingKey, String alg, Key transportKey, String encAlg, String encEnc, KeyJar keyjar, String sender, String receiver)
457449
throws SerializationException {
458450
header = new HashMap<String, Object>();
459451
header.put("alg", alg);
@@ -500,7 +492,7 @@ public String toJwt(Key signingKey, String alg, Key transportKey, String encAlg,
500492
}
501493
try {
502494
return JWTEncryptor.init().withPayload(signedJwt.getBytes("UTF-8")).encrypt(
503-
AlgorithmResolver.resolveKeyTransportAlgorithmForEncryption(transportKey, encAlg),
495+
AlgorithmResolver.resolveKeyTransportAlgorithmForEncryption(transportKey, encAlg, encEnc, keyjar, sender, receiver),
504496
Algorithm.getContentEncryptionAlg(encEnc, CipherParams.getInstance(encEnc)));
505497
} catch (UnsupportedEncodingException | ValueError | SerializationNotPossible e) {
506498
throw new SerializationException(

‎src/main/java/org/oidc/msg/Message.java‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,14 +48,28 @@ public interface Message {
4848
/**
4949
* Serialize the content of this instance (the claims map) into a jwt string.
5050
*
51-
* @param key
51+
* @param signingKey
5252
* signing key
5353
* @param alg
54-
* signing algorithm
54+
* signing algorithm name
55+
* @param transportKey
56+
* key transport key, if null encryption is not done.
57+
* @param encAlg
58+
* key transport algorithm name. Must not be null if transportKey is set.
59+
* @param encEnc
60+
* content encryption algorithm name. Must not be null if transportKey is set.
61+
* @param keyjar
62+
* key jar containing receiver ephemeral public key when using ECDH
63+
* family of key transport
64+
* @param sender
65+
* sender i.e. client id
66+
* @param receiver
67+
* receiver i.e. issuer id of the o.
5568
* @return message as jwt string.
56-
* @throws SerializationException Thrown if message cannot be serialized.
5769
*/
58-
String toJwt(Key key, String alg) throws SerializationException;
70+
71+
public String toJwt(Key signingKey, String alg, Key transportKey, String encAlg, String encEnc,
72+
KeyJar keyjar, String sender, String receiver) throws SerializationException;
5973

6074
/**
6175
* Constructs a message from the JSON string.

‎src/test/java/org/oidc/msg/AbstractMessageTest.java‎

Lines changed: 68 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -20,27 +20,30 @@
2020
import com.auth0.jwt.JWTVerifier;
2121
import com.auth0.jwt.algorithms.Algorithm;
2222
import com.auth0.jwt.exceptions.JWTDecodeException;
23+
import com.auth0.jwt.exceptions.oicmsg_exceptions.HeaderError;
2324
import com.auth0.jwt.exceptions.oicmsg_exceptions.ImportException;
2425
import com.auth0.jwt.exceptions.oicmsg_exceptions.JWKException;
26+
import com.auth0.jwt.exceptions.oicmsg_exceptions.SerializationNotPossible;
2527
import com.auth0.jwt.exceptions.oicmsg_exceptions.UnknownKeyType;
2628
import com.auth0.jwt.exceptions.oicmsg_exceptions.ValueError;
2729
import com.auth0.jwt.interfaces.DecodedJWT;
30+
import com.auth0.msg.ECKey;
2831
import com.auth0.msg.Key;
32+
import com.auth0.msg.KeyBundle;
2933
import com.auth0.msg.KeyJar;
30-
//import com.auth0.msg.KeyType;
3134
import com.auth0.msg.SYMKey;
3235
import com.fasterxml.jackson.core.JsonProcessingException;
3336
import java.io.IOException;
3437
import java.lang.reflect.Array;
3538
import java.net.MalformedURLException;
39+
import java.security.KeyPair;
3640
import java.security.interfaces.RSAPublicKey;
3741
import java.util.ArrayList;
3842
import java.util.Arrays;
3943
import java.util.Date;
4044
import java.util.HashMap;
4145
import java.util.List;
4246
import java.util.Map;
43-
4447
import org.hamcrest.CoreMatchers;
4548
import org.junit.Assert;
4649
import org.junit.Before;
@@ -128,7 +131,7 @@ public void testSuccessToAndFromJWTNoneAlgBasicTypes() throws IOException, Inval
128131
claims.put("foo4", 5L);
129132
MockMessage mockMessage = new MockMessage(claims, parVerDef);
130133
mockMessage.verify();
131-
String jwt = mockMessage.toJwt(null, "none");
134+
String jwt = mockMessage.toJwt(null, "none", null, null, null, null, null, null);
132135
// Test jwt can be verified by auth0
133136
Algorithm algorithm = Algorithm.none();
134137
JWTVerifier verifier = JWT.require(algorithm).build();
@@ -153,25 +156,60 @@ public void testSuccessToAndFromJWTNoneAlgBasicTypes() throws IOException, Inval
153156

154157
private void testSuccessJWTEncryptDecrypt(String alg, String encAlg, String encEnc)
155158
throws IOException, InvalidClaimException, SerializationException, DeserializationException,
156-
IllegalArgumentException, ImportException, UnknownKeyType, ValueError, JWKException {
159+
IllegalArgumentException, ImportException, UnknownKeyType, ValueError, JWKException, HeaderError, SerializationNotPossible {
157160
//Initial test for jwt encryption. Not at all complete case.
158161
HashMap<String, Object> claims = new HashMap<String, Object>();
159162
claims.put("foo", "bar");
160163
MockMessage mockMessage = new MockMessage(claims);
161164
List<Key> keysDec = getKeyJar().getDecryptKey(null, keyOwner, null, null);
162165
List<Key> keysEnc = getKeyJarPub().getEncryptKey(null, keyOwner, null, null);
163-
int index=0;
164-
if (encAlg.equals("A128KW")){
165-
index=1;
166-
}
167-
if (encAlg.equals("A192KW")){
168-
index=2;
169-
}
170-
if (encAlg.equals("A256KW")){
171-
index=3;
166+
String signedAndEncryptedJwt = null;
167+
if (encAlg.equals("A128KW")) {
168+
signedAndEncryptedJwt = mockMessage.toJwt(keysDec.get(0), alg, keysEnc.get(1), encAlg,
169+
encEnc, null, null, null);
170+
} else if (encAlg.equals("A192KW")) {
171+
signedAndEncryptedJwt = mockMessage.toJwt(keysDec.get(0), alg, keysEnc.get(2), encAlg,
172+
encEnc, null, null, null);
173+
} else if (encAlg.equals("A256KW")) {
174+
signedAndEncryptedJwt = mockMessage.toJwt(keysDec.get(0), alg, keysEnc.get(3), encAlg,
175+
encEnc, null, null, null);
176+
} else if (encAlg.startsWith("ECDH")) {
177+
178+
//For ECDH we need to do bit more complicated test
179+
KeyPair senderKeyPair = ECKey.generateECKeyPair("P-256");
180+
ECKey senderKey = ECKey.keyBuilder(senderKeyPair.getPrivate()).build();
181+
KeyPair receiverKeyPair = ECKey.generateECKeyPair("P-256");
182+
ECKey receiverPubKey = ECKey.keyBuilder(receiverKeyPair.getPublic()).build();
183+
ECKey receiverPrvKey = ECKey.keyBuilder(receiverKeyPair.getPrivate()).build();
184+
senderKey.setUse("enc");
185+
//Key jar of sender
186+
KeyJar keyjarSender=new KeyJar();
187+
KeyBundle keyBundlePub = new KeyBundle();
188+
keyBundlePub.append(receiverPubKey);
189+
//Receiver public key is expected to be in the key jar of sender
190+
keyjarSender.addKeyBundle("receiver", keyBundlePub);
191+
signedAndEncryptedJwt = mockMessage.toJwt(keysDec.get(0), alg, senderKey, encAlg,
192+
encEnc, keyjarSender, "sender","receiver");
193+
//Key jar of receiver is expected to have private key of the receiver
194+
KeyBundle keyBundlePrv = new KeyBundle();
195+
keyBundlePrv.append(receiverPrvKey);
196+
KeyJar keyjarReceiver=new KeyJar();
197+
keyjarReceiver.addKeyBundle("sender", keyBundlePrv);
198+
receiverPubKey.setUse("enc");
199+
200+
for (KeyBundle bundle:getKeyJar().getBundles().get(keyOwner)) {
201+
keyjarReceiver.addKeyBundle("sender", bundle);
202+
}
203+
MockMessage mockMessage2 = new MockMessage();
204+
mockMessage2.fromJwt(signedAndEncryptedJwt, keyjarReceiver, "sender");
205+
Assert.assertEquals("bar", mockMessage2.getClaims().get("foo"));
206+
return;
207+
208+
} else {
209+
//Default
210+
signedAndEncryptedJwt = mockMessage.toJwt(keysDec.get(0), alg, keysEnc.get(0), encAlg,
211+
encEnc, null, null, null);
172212
}
173-
String signedAndEncryptedJwt=mockMessage.toJwt(keysDec.get(0), alg, keysEnc.get(index), encAlg,
174-
encEnc);
175213
MockMessage mockMessage2 = new MockMessage();
176214
mockMessage2.fromJwt(signedAndEncryptedJwt, getKeyJar(), keyOwner);
177215
Assert.assertEquals("bar", mockMessage2.getClaims().get("foo"));
@@ -181,7 +219,7 @@ private void testSuccessJWTEncryptDecrypt(String alg, String encAlg, String encE
181219
@Test
182220
public void testSuccessJWTEncryptDecrypt1()
183221
throws IOException, InvalidClaimException, SerializationException, DeserializationException,
184-
IllegalArgumentException, ImportException, UnknownKeyType, ValueError, JWKException {
222+
IllegalArgumentException, ImportException, UnknownKeyType, ValueError, JWKException, HeaderError, SerializationNotPossible {
185223

186224
testSuccessJWTEncryptDecrypt("RS256","RSA1_5","A128CBC-HS256");
187225
testSuccessJWTEncryptDecrypt("RS384","RSA-OAEP","A192CBC-HS384");
@@ -190,8 +228,14 @@ public void testSuccessJWTEncryptDecrypt1()
190228
testSuccessJWTEncryptDecrypt("RS384","RSA-OAEP","A192GCM");
191229
testSuccessJWTEncryptDecrypt("RS512","RSA-OAEP-256","A256GCM");
192230
testSuccessJWTEncryptDecrypt("RS256","A128KW","A128CBC-HS256");
193-
testSuccessJWTEncryptDecrypt("RS256","A192KW","A128CBC-HS256");
194-
testSuccessJWTEncryptDecrypt("RS256","A256KW","A128CBC-HS256");
231+
testSuccessJWTEncryptDecrypt("RS384","A192KW","A128CBC-HS256");
232+
testSuccessJWTEncryptDecrypt("RS512","A256KW","A128CBC-HS256");
233+
//TODO: not passing
234+
//testSuccessJWTEncryptDecrypt("RS256","ECDH-ES","A128CBC-HS256");
235+
testSuccessJWTEncryptDecrypt("RS256","ECDH-ES+A128KW","A128GCM");
236+
testSuccessJWTEncryptDecrypt("RS384","ECDH-ES+A192KW","A192GCM");
237+
testSuccessJWTEncryptDecrypt("RS512","ECDH-ES+A256KW","A256GCM");
238+
195239
}
196240

197241
@Test
@@ -205,15 +249,15 @@ public void testSuccessToJWTSignRS()
205249
MockMessage mockMessage = new MockMessage(claims);
206250
DecodedJWT jwt = JWT
207251
.require(Algorithm.RSA256((RSAPublicKey) keysVerify.get(0).getKey(false), null)).build()
208-
.verify(mockMessage.toJwt(keysSign.get(0), "RS256"));
252+
.verify(mockMessage.toJwt(keysSign.get(0), "RS256", null, null, null, null, null, null));
209253
Assert.assertEquals("bar", jwt.getClaim("foo").asString());
210254
Assert.assertEquals("RS256", jwt.getHeaderClaim("alg").asString());
211255
jwt = JWT.require(Algorithm.RSA384((RSAPublicKey) keysVerify.get(0).getKey(false), null))
212-
.build().verify(mockMessage.toJwt(keysSign.get(0), "RS384"));
256+
.build().verify(mockMessage.toJwt(keysSign.get(0), "RS384", null, null, null, null, null, null));
213257
Assert.assertEquals("bar", jwt.getClaim("foo").asString());
214258
Assert.assertEquals("RS384", jwt.getHeaderClaim("alg").asString());
215259
jwt = JWT.require(Algorithm.RSA512((RSAPublicKey) keysVerify.get(0).getKey(false), null))
216-
.build().verify(mockMessage.toJwt(keysSign.get(0), "RS512"));
260+
.build().verify(mockMessage.toJwt(keysSign.get(0), "RS512", null, null, null, null, null, null));
217261
Assert.assertEquals("bar", jwt.getClaim("foo").asString());
218262
Assert.assertEquals("RS512", jwt.getHeaderClaim("alg").asString());
219263
}
@@ -229,15 +273,15 @@ public void testSuccessToJWTSignHS()
229273
MockMessage mockMessage = new MockMessage(claims);
230274
DecodedJWT jwt = JWT
231275
.require(Algorithm.HMAC256(secret)).build()
232-
.verify(mockMessage.toJwt(key, "HS256"));
276+
.verify(mockMessage.toJwt(key, "HS256", null, null, null, null, null, null));
233277
Assert.assertEquals("bar", jwt.getClaim("foo").asString());
234278
Assert.assertEquals("HS256", jwt.getHeaderClaim("alg").asString());
235279
jwt = JWT.require(Algorithm.HMAC384(secret))
236-
.build().verify(mockMessage.toJwt(key, "HS384"));
280+
.build().verify(mockMessage.toJwt(key, "HS384", null, null, null, null, null, null));
237281
Assert.assertEquals("bar", jwt.getClaim("foo").asString());
238282
Assert.assertEquals("HS384", jwt.getHeaderClaim("alg").asString());
239283
jwt = JWT.require(Algorithm.HMAC512(secret))
240-
.build().verify(mockMessage.toJwt(key, "HS512"));
284+
.build().verify(mockMessage.toJwt(key, "HS512", null, null, null, null, null, null));
241285
Assert.assertEquals("bar", jwt.getClaim("foo").asString());
242286
Assert.assertEquals("HS512", jwt.getHeaderClaim("alg").asString());
243287
}

‎src/test/java/org/oidc/msg/BaseMessageTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -257,7 +257,7 @@ protected String generateIdTokenNow(Map<String, Object> claims, Key key, String
257257
claims.put("iat", new Date());
258258
IDToken token = new IDToken(claims);
259259
token.verify();
260-
return token.toJwt(key, algo);
260+
return token.toJwt(key, algo, null, null, null, null, null, null);
261261
}
262262

263263
/**

‎src/test/java/org/oidc/msg/oidc/AuthenticationRequestTest.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ public void testSuccessIdTokenHint() throws InvalidClaimException, IllegalArgume
143143
ImportException, UnknownKeyType, ValueError, IOException, JWKException, SerializationException, DeserializationException {
144144
IDToken idTokenHint = getIDTokenHint();
145145
List<Key> keysSign = getKeyJar().getSigningKey("RSA", keyOwner, null, null);
146-
claims.put("id_token_hint", idTokenHint.toJwt(keysSign.get(0), "RS256"));
146+
claims.put("id_token_hint", idTokenHint.toJwt(keysSign.get(0), "RS256", null, null, null, null, null, null));
147147
AuthenticationRequest req = new AuthenticationRequest(claims);
148148
Assert.assertTrue(req.verify());
149149
IDToken idTokenHintFromJwt = new IDToken();
@@ -194,7 +194,7 @@ public void testUrlEncodingSuccess()
194194
claims.put("ui_locales", locales);
195195
IDToken idTokenHint = getIDTokenHint();
196196
List<Key> keysSign = getKeyJar().getSigningKey("RSA", keyOwner, null, null);
197-
claims.put("id_token_hint", idTokenHint.toJwt(keysSign.get(0), "RS256"));
197+
claims.put("id_token_hint", idTokenHint.toJwt(keysSign.get(0), "RS256", null, null, null, null, null, null));
198198
claims.put("login_hint", "user_is_bob");
199199
String[] acrs = new String[2];
200200
acrs[0] = "1";
@@ -204,7 +204,7 @@ public void testUrlEncodingSuccess()
204204
claims.put("claims", claimsRequest.toJson());
205205
RequestObject requestObject = new RequestObject(claims);
206206
Assert.assertTrue(requestObject.verify());
207-
claims.put("request", requestObject.toJwt(keysSign.get(0), "RS256"));
207+
claims.put("request", requestObject.toJwt(keysSign.get(0), "RS256", null, null, null, null, null, null));
208208
message = new AuthenticationRequest(claims);
209209
message.verify();
210210
AuthenticationRequest messageParsed = new AuthenticationRequest();

0 commit comments

Comments
 (0)