Skip to content

Commit ebb4f2c

Browse files
jricherjricher
committed
Upgraded to nimbus 4.2, closes mitreid-connect#934 
1 parent c67611e commit ebb4f2c

File tree

16 files changed

+153
-155
lines changed

16 files changed

+153
-155
lines changed

‎openid-connect-client/src/main/java/org/mitre/openid/connect/client/NamedAdminAuthoritiesMapper.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
import org.springframework.security.core.authority.SimpleGrantedAuthority;
3232

3333
import com.nimbusds.jwt.JWT;
34-
import com.nimbusds.jwt.ReadOnlyJWTClaimsSet;
34+
import com.nimbusds.jwt.JWTClaimsSet;
3535

3636
/**
3737
*
@@ -56,7 +56,7 @@ public Collection<? extends GrantedAuthority> mapAuthorities(JWT idToken, UserIn
5656

5757
Set<GrantedAuthority> out = new HashSet<>();
5858
try {
59-
ReadOnlyJWTClaimsSet claims = idToken.getJWTClaimsSet();
59+
JWTClaimsSet claims = idToken.getJWTClaimsSet();
6060

6161
SubjectIssuerGrantedAuthority authority = new SubjectIssuerGrantedAuthority(claims.getSubject(), claims.getIssuer());
6262
out.add(authority);

‎openid-connect-client/src/main/java/org/mitre/openid/connect/client/OIDCAuthenticationFilter.java‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@
1616
*******************************************************************************/
1717
package org.mitre.openid.connect.client;
1818

19+
import static org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod.PRIVATE_KEY;
20+
import static org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod.SECRET_BASIC;
21+
import static org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod.SECRET_JWT;
22+
1923
import java.io.IOException;
2024
import java.math.BigInteger;
2125
import java.net.URI;
@@ -75,13 +79,8 @@
7579
import com.nimbusds.jwt.JWTClaimsSet;
7680
import com.nimbusds.jwt.JWTParser;
7781
import com.nimbusds.jwt.PlainJWT;
78-
import com.nimbusds.jwt.ReadOnlyJWTClaimsSet;
7982
import com.nimbusds.jwt.SignedJWT;
8083

81-
import static org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod.PRIVATE_KEY;
82-
import static org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod.SECRET_BASIC;
83-
import static org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod.SECRET_JWT;
84-
8584
/**
8685
* OpenID Connect Authentication Filter class
8786
*
@@ -374,25 +373,25 @@ protected ClientHttpRequest createRequest(URI url, HttpMethod method) throws IOE
374373
throw new AuthenticationServiceException("Couldn't find required signer service for use with private key auth.");
375374
}
376375

377-
JWTClaimsSet claimsSet = new JWTClaimsSet();
376+
JWTClaimsSet.Builder claimsSet = new JWTClaimsSet.Builder();
378377

379-
claimsSet.setIssuer(clientConfig.getClientId());
380-
claimsSet.setSubject(clientConfig.getClientId());
381-
claimsSet.setAudience(Lists.newArrayList(serverConfig.getTokenEndpointUri()));
382-
claimsSet.setJWTID(UUID.randomUUID().toString());
378+
claimsSet.issuer(clientConfig.getClientId());
379+
claimsSet.subject(clientConfig.getClientId());
380+
claimsSet.audience(Lists.newArrayList(serverConfig.getTokenEndpointUri()));
381+
claimsSet.jwtID(UUID.randomUUID().toString());
383382

384383
// TODO: make this configurable
385384
Date exp = new Date(System.currentTimeMillis() + (60 * 1000)); // auth good for 60 seconds
386-
claimsSet.setExpirationTime(exp);
385+
claimsSet.expirationTime(exp);
387386

388387
Date now = new Date(System.currentTimeMillis());
389-
claimsSet.setIssueTime(now);
390-
claimsSet.setNotBeforeTime(now);
388+
claimsSet.issueTime(now);
389+
claimsSet.notBeforeTime(now);
391390

392391
JWSHeader header = new JWSHeader(alg, null, null, null, null, null, null, null, null, null,
393392
signer.getDefaultSignerKeyId(),
394393
null, null);
395-
SignedJWT jwt = new SignedJWT(header, claimsSet);
394+
SignedJWT jwt = new SignedJWT(header, claimsSet.build());
396395

397396
signer.signJwt(jwt, alg);
398397

@@ -472,7 +471,7 @@ protected ClientHttpRequest createRequest(URI url, HttpMethod method) throws IOE
472471
JWT idToken = JWTParser.parse(idTokenValue);
473472

474473
// validate our ID Token over a number of tests
475-
ReadOnlyJWTClaimsSet idClaims = idToken.getJWTClaimsSet();
474+
JWTClaimsSet idClaims = idToken.getJWTClaimsSet();
476475

477476
// check the signature
478477
JWTSigningAndValidationService jwtValidator = null;

‎openid-connect-client/src/main/java/org/mitre/openid/connect/client/service/impl/EncryptedAuthRequestUrlBuilder.java‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -58,33 +58,33 @@ public class EncryptedAuthRequestUrlBuilder implements AuthRequestUrlBuilder {
5858
public String buildAuthRequestUrl(ServerConfiguration serverConfig, RegisteredClient clientConfig, String redirectUri, String nonce, String state, Map<String, String> options, String loginHint) {
5959

6060
// create our signed JWT for the request object
61-
JWTClaimsSet claims = new JWTClaimsSet();
61+
JWTClaimsSet.Builder claims = new JWTClaimsSet.Builder();
6262

6363
//set parameters to JwtClaims
64-
claims.setClaim("response_type", "code");
65-
claims.setClaim("client_id", clientConfig.getClientId());
66-
claims.setClaim("scope", Joiner.on(" ").join(clientConfig.getScope()));
64+
claims.claim("response_type", "code");
65+
claims.claim("client_id", clientConfig.getClientId());
66+
claims.claim("scope", Joiner.on(" ").join(clientConfig.getScope()));
6767

6868
// build our redirect URI
69-
claims.setClaim("redirect_uri", redirectUri);
69+
claims.claim("redirect_uri", redirectUri);
7070

7171
// this comes back in the id token
72-
claims.setClaim("nonce", nonce);
72+
claims.claim("nonce", nonce);
7373

7474
// this comes back in the auth request return
75-
claims.setClaim("state", state);
75+
claims.claim("state", state);
7676

7777
// Optional parameters
7878
for (Entry<String, String> option : options.entrySet()) {
79-
claims.setClaim(option.getKey(), option.getValue());
79+
claims.claim(option.getKey(), option.getValue());
8080
}
8181

8282
// if there's a login hint, send it
8383
if (!Strings.isNullOrEmpty(loginHint)) {
84-
claims.setClaim("login_hint", loginHint);
84+
claims.claim("login_hint", loginHint);
8585
}
8686

87-
EncryptedJWT jwt = new EncryptedJWT(new JWEHeader(alg, enc), claims);
87+
EncryptedJWT jwt = new EncryptedJWT(new JWEHeader(alg, enc), claims.build());
8888

8989
JWTEncryptionAndDecryptionService encryptor = encrypterService.getEncrypter(serverConfig.getJwksUri());
9090

‎openid-connect-client/src/main/java/org/mitre/openid/connect/client/service/impl/SignedAuthRequestUrlBuilder.java‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -52,38 +52,38 @@ public class SignedAuthRequestUrlBuilder implements AuthRequestUrlBuilder {
5252
public String buildAuthRequestUrl(ServerConfiguration serverConfig, RegisteredClient clientConfig, String redirectUri, String nonce, String state, Map<String, String> options, String loginHint) {
5353

5454
// create our signed JWT for the request object
55-
JWTClaimsSet claims = new JWTClaimsSet();
55+
JWTClaimsSet.Builder claims = new JWTClaimsSet.Builder();
5656

5757
//set parameters to JwtClaims
58-
claims.setClaim("response_type", "code");
59-
claims.setClaim("client_id", clientConfig.getClientId());
60-
claims.setClaim("scope", Joiner.on(" ").join(clientConfig.getScope()));
58+
claims.claim("response_type", "code");
59+
claims.claim("client_id", clientConfig.getClientId());
60+
claims.claim("scope", Joiner.on(" ").join(clientConfig.getScope()));
6161

6262
// build our redirect URI
63-
claims.setClaim("redirect_uri", redirectUri);
63+
claims.claim("redirect_uri", redirectUri);
6464

6565
// this comes back in the id token
66-
claims.setClaim("nonce", nonce);
66+
claims.claim("nonce", nonce);
6767

6868
// this comes back in the auth request return
69-
claims.setClaim("state", state);
69+
claims.claim("state", state);
7070

7171
// Optional parameters
7272
for (Entry<String, String> option : options.entrySet()) {
73-
claims.setClaim(option.getKey(), option.getValue());
73+
claims.claim(option.getKey(), option.getValue());
7474
}
7575

7676
// if there's a login hint, send it
7777
if (!Strings.isNullOrEmpty(loginHint)) {
78-
claims.setClaim("login_hint", loginHint);
78+
claims.claim("login_hint", loginHint);
7979
}
8080

8181
JWSAlgorithm alg = clientConfig.getRequestObjectSigningAlg();
8282
if (alg == null) {
8383
alg = signingAndValidationService.getDefaultSigningAlgorithm();
8484
}
8585

86-
SignedJWT jwt = new SignedJWT(new JWSHeader(alg), claims);
86+
SignedJWT jwt = new SignedJWT(new JWSHeader(alg), claims.build());
8787

8888
signingAndValidationService.signJwt(jwt, alg);
8989

‎openid-connect-client/src/test/java/org/mitre/openid/connect/client/service/impl/TestSignedAuthRequestUrlBuilder.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@
4343
import com.nimbusds.jose.jwk.KeyUse;
4444
import com.nimbusds.jose.jwk.RSAKey;
4545
import com.nimbusds.jose.util.Base64URL;
46-
import com.nimbusds.jwt.ReadOnlyJWTClaimsSet;
46+
import com.nimbusds.jwt.JWTClaimsSet;
4747
import com.nimbusds.jwt.SignedJWT;
4848

4949
import static org.junit.Assert.assertEquals;
@@ -130,7 +130,7 @@ public void buildAuthRequestUrl() {
130130

131131
UriComponents components = builder.build();
132132
String jwtString = components.getQueryParams().get("request").get(0);
133-
ReadOnlyJWTClaimsSet claims = null;
133+
JWTClaimsSet claims = null;
134134

135135
try {
136136
SignedJWT jwt = SignedJWT.parse(jwtString);
@@ -169,7 +169,7 @@ public void buildAuthRequestUrl_withLoginHint() {
169169

170170
UriComponents components = builder.build();
171171
String jwtString = components.getQueryParams().get("request").get(0);
172-
ReadOnlyJWTClaimsSet claims = null;
172+
JWTClaimsSet claims = null;
173173

174174
try {
175175
SignedJWT jwt = SignedJWT.parse(jwtString);

‎openid-connect-common/src/main/java/org/mitre/jwt/encryption/service/impl/DefaultJWTEncryptionAndDecryptionService.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -272,11 +272,11 @@ public Collection<JWEAlgorithm> getAllEncryptionAlgsSupported() {
272272
Set<JWEAlgorithm> algs = new HashSet<>();
273273

274274
for (JWEEncrypter encrypter : encrypters.values()) {
275-
algs.addAll(encrypter.supportedAlgorithms());
275+
algs.addAll(encrypter.supportedJWEAlgorithms());
276276
}
277277

278278
for (JWEDecrypter decrypter : decrypters.values()) {
279-
algs.addAll(decrypter.supportedAlgorithms());
279+
algs.addAll(decrypter.supportedJWEAlgorithms());
280280
}
281281

282282
return algs;

‎openid-connect-common/src/main/java/org/mitre/jwt/signer/service/impl/DefaultJWTSigningAndValidationService.java‎

Lines changed: 43 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717
package org.mitre.jwt.signer.service.impl;
1818

1919
import java.security.NoSuchAlgorithmException;
20+
import java.security.interfaces.ECPrivateKey;
21+
import java.security.interfaces.ECPublicKey;
2022
import java.security.spec.InvalidKeySpecException;
2123
import java.util.Collection;
2224
import java.util.HashMap;
@@ -160,41 +162,45 @@ private void buildSignersAndVerifiers() throws NoSuchAlgorithmException, Invalid
160162
String id = jwkEntry.getKey();
161163
JWK jwk = jwkEntry.getValue();
162164

163-
if (jwk instanceof RSAKey) {
164-
// build RSA signers & verifiers
165-
166-
if (jwk.isPrivate()) { // only add the signer if there's a private key
167-
RSASSASigner signer = new RSASSASigner(((RSAKey) jwk).toRSAPrivateKey());
168-
signers.put(id, signer);
169-
}
170-
171-
RSASSAVerifier verifier = new RSASSAVerifier(((RSAKey) jwk).toRSAPublicKey());
172-
verifiers.put(id, verifier);
173-
174-
} else if (jwk instanceof ECKey) {
175-
// build EC signers & verifiers
176-
177-
if (jwk.isPrivate()) {
178-
ECDSASigner signer = new ECDSASigner(((ECKey) jwk).getD().decodeToBigInteger());
179-
signers.put(id, signer);
180-
}
181-
182-
ECDSAVerifier verifier = new ECDSAVerifier(((ECKey) jwk).getX().decodeToBigInteger(), ((ECKey) jwk).getY().decodeToBigInteger());
183-
verifiers.put(id, verifier);
184-
185-
} else if (jwk instanceof OctetSequenceKey) {
186-
// build HMAC signers & verifiers
187-
188-
if (jwk.isPrivate()) { // technically redundant check because all HMAC keys are private
189-
MACSigner signer = new MACSigner(((OctetSequenceKey) jwk).toByteArray());
190-
signers.put(id, signer);
165+
try {
166+
if (jwk instanceof RSAKey) {
167+
// build RSA signers & verifiers
168+
169+
if (jwk.isPrivate()) { // only add the signer if there's a private key
170+
RSASSASigner signer = new RSASSASigner((RSAKey) jwk);
171+
signers.put(id, signer);
172+
}
173+
174+
RSASSAVerifier verifier = new RSASSAVerifier((RSAKey) jwk);
175+
verifiers.put(id, verifier);
176+
177+
} else if (jwk instanceof ECKey) {
178+
// build EC signers & verifiers
179+
180+
if (jwk.isPrivate()) {
181+
ECDSASigner signer = new ECDSASigner((ECKey) jwk);
182+
signers.put(id, signer);
183+
}
184+
185+
ECDSAVerifier verifier = new ECDSAVerifier((ECKey) jwk);
186+
verifiers.put(id, verifier);
187+
188+
} else if (jwk instanceof OctetSequenceKey) {
189+
// build HMAC signers & verifiers
190+
191+
if (jwk.isPrivate()) { // technically redundant check because all HMAC keys are private
192+
MACSigner signer = new MACSigner((OctetSequenceKey) jwk);
193+
signers.put(id, signer);
194+
}
195+
196+
MACVerifier verifier = new MACVerifier((OctetSequenceKey) jwk);
197+
verifiers.put(id, verifier);
198+
199+
} else {
200+
logger.warn("Unknown key type: " + jwk);
191201
}
192-
193-
MACVerifier verifier = new MACVerifier(((OctetSequenceKey) jwk).toByteArray());
194-
verifiers.put(id, verifier);
195-
196-
} else {
197-
logger.warn("Unknown key type: " + jwk);
202+
} catch (JOSEException e) {
203+
logger.warn("Exception loading signer/verifier", e);
198204
}
199205
}
200206

@@ -230,7 +236,7 @@ public void signJwt(SignedJWT jwt, JWSAlgorithm alg) {
230236
JWSSigner signer = null;
231237

232238
for (JWSSigner s : signers.values()) {
233-
if (s.supportedAlgorithms().contains(alg)) {
239+
if (s.supportedJWSAlgorithms().contains(alg)) {
234240
signer = s;
235241
break;
236242
}
@@ -292,11 +298,11 @@ public Collection<JWSAlgorithm> getAllSigningAlgsSupported() {
292298
Set<JWSAlgorithm> algs = new HashSet<>();
293299

294300
for (JWSSigner signer : signers.values()) {
295-
algs.addAll(signer.supportedAlgorithms());
301+
algs.addAll(signer.supportedJWSAlgorithms());
296302
}
297303

298304
for (JWSVerifier verifier : verifiers.values()) {
299-
algs.addAll(verifier.supportedAlgorithms());
305+
algs.addAll(verifier.supportedJWSAlgorithms());
300306
}
301307

302308
return algs;

‎openid-connect-common/src/test/java/org/mitre/jwt/encryption/service/impl/TestDefaultJWTEncryptionAndDecryptionService.java‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@
4242
import com.nimbusds.jose.util.JSONObjectUtils;
4343
import com.nimbusds.jwt.EncryptedJWT;
4444
import com.nimbusds.jwt.JWTClaimsSet;
45-
import com.nimbusds.jwt.ReadOnlyJWTClaimsSet;
4645

4746
import static org.hamcrest.CoreMatchers.nullValue;
4847

@@ -63,7 +62,7 @@ public class TestDefaultJWTEncryptionAndDecryptionService {
6362

6463
private String issuer = "www.example.net";
6564
private String subject = "example_user";
66-
private JWTClaimsSet claimsSet = new JWTClaimsSet();
65+
private JWTClaimsSet claimsSet = null;
6766

6867
// Example data taken from Mike Jones's draft-ietf-jose-json-web-encryption-14 appendix examples
6968
private String compactSerializedJwe = "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ." +
@@ -152,8 +151,10 @@ public void prepare() throws NoSuchAlgorithmException, InvalidKeySpecException,
152151
service_3 = new DefaultJWTEncryptionAndDecryptionService(keys_3);
153152
service_4 = new DefaultJWTEncryptionAndDecryptionService(keys_4);
154153

155-
claimsSet.setIssuer(issuer);
156-
claimsSet.setSubject(subject);
154+
claimsSet = new JWTClaimsSet.Builder()
155+
.issuer(issuer)
156+
.subject(subject)
157+
.build();
157158

158159
// Key Store
159160

@@ -203,7 +204,7 @@ public void encryptThenDecrypt_RSA() throws ParseException {
203204
assertThat(encryptedJwt.getJWTClaimsSet(), nullValue());
204205
service.decryptJwt(encryptedJwt);
205206

206-
ReadOnlyJWTClaimsSet resultClaims = encryptedJwt.getJWTClaimsSet();
207+
JWTClaimsSet resultClaims = encryptedJwt.getJWTClaimsSet();
207208

208209
assertEquals(claimsSet.getIssuer(), resultClaims.getIssuer());
209210
assertEquals(claimsSet.getSubject(), resultClaims.getSubject());
@@ -231,7 +232,7 @@ public void encryptThenDecrypt_nullID() throws ParseException {
231232
assertThat(encryptedJwt.getJWTClaimsSet(), nullValue());
232233
service.decryptJwt(encryptedJwt);
233234

234-
ReadOnlyJWTClaimsSet resultClaims = encryptedJwt.getJWTClaimsSet();
235+
JWTClaimsSet resultClaims = encryptedJwt.getJWTClaimsSet();
235236

236237
assertEquals(claimsSet.getIssuer(), resultClaims.getIssuer());
237238
assertEquals(claimsSet.getSubject(), resultClaims.getSubject());

0 commit comments

Comments
 (0)