Skip to content

Commit f04face

Browse files
jricherjricher
committed
updated to nimbus 4.3, check JCE policy and algorithm availability before running unit tests, closes mitreid-connect#938 
1 parent 2deec98 commit f04face

File tree

4 files changed

+91
-23
lines changed

4 files changed

+91
-23
lines changed

‎openid-connect-common/pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,10 @@
8282
<groupId>com.fasterxml.jackson.core</groupId>
8383
<artifactId>jackson-annotations</artifactId>
8484
</dependency>
85+
<dependency>
86+
<groupId>org.bouncycastle</groupId>
87+
<artifactId>bcprov-jdk15on</artifactId>
88+
</dependency>
8589
</dependencies>
8690

8791
<packaging>jar</packaging>

‎openid-connect-common/src/main/java/org/mitre/jwt/encryption/service/impl/DefaultJWTEncryptionAndDecryptionService.java‎

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,13 @@
4040
import com.nimbusds.jose.JWEObject;
4141
import com.nimbusds.jose.crypto.DirectDecrypter;
4242
import com.nimbusds.jose.crypto.DirectEncrypter;
43+
import com.nimbusds.jose.crypto.ECDHDecrypter;
44+
import com.nimbusds.jose.crypto.ECDHEncrypter;
4345
import com.nimbusds.jose.crypto.RSADecrypter;
4446
import com.nimbusds.jose.crypto.RSAEncrypter;
47+
import com.nimbusds.jose.crypto.bc.BouncyCastleProviderSingleton;
48+
import com.nimbusds.jose.jca.JCAContext;
49+
import com.nimbusds.jose.jwk.ECKey;
4550
import com.nimbusds.jose.jwk.JWK;
4651
import com.nimbusds.jose.jwk.OctetSequenceKey;
4752
import com.nimbusds.jose.jwk.RSAKey;
@@ -223,23 +228,40 @@ private void buildEncryptersAndDecrypters() throws NoSuchAlgorithmException, Inv
223228
if (jwk instanceof RSAKey) {
224229
// build RSA encrypters and decrypters
225230

226-
RSAEncrypter encrypter = new RSAEncrypter(((RSAKey) jwk).toRSAPublicKey()); // there should always at least be the public key
231+
RSAEncrypter encrypter = new RSAEncrypter((RSAKey) jwk); // there should always at least be the public key
232+
encrypter.getJCAContext().setProvider(BouncyCastleProviderSingleton.getInstance());
227233
encrypters.put(id, encrypter);
228234

229235
if (jwk.isPrivate()) { // we can decrypt!
230-
RSADecrypter decrypter = new RSADecrypter(((RSAKey) jwk).toRSAPrivateKey());
236+
RSADecrypter decrypter = new RSADecrypter((RSAKey) jwk);
237+
decrypter.getJCAContext().setProvider(BouncyCastleProviderSingleton.getInstance());
231238
decrypters.put(id, decrypter);
232239
} else {
233240
logger.warn("No private key for key #" + jwk.getKeyID());
234241
}
235-
236-
// TODO: add support for EC keys
242+
} else if (jwk instanceof ECKey) {
243+
244+
// build EC Encrypters and decrypters
245+
246+
ECDHEncrypter encrypter = new ECDHEncrypter((ECKey) jwk);
247+
encrypter.getJCAContext().setProvider(BouncyCastleProviderSingleton.getInstance());
248+
encrypters.put(id, encrypter);
249+
250+
if (jwk.isPrivate()) { // we can decrypt too
251+
ECDHDecrypter decrypter = new ECDHDecrypter((ECKey) jwk);
252+
decrypter.getJCAContext().setProvider(BouncyCastleProviderSingleton.getInstance());
253+
decrypters.put(id, decrypter);
254+
} else {
255+
logger.warn("No private key for key # " + jwk.getKeyID());
256+
}
237257

238258
} else if (jwk instanceof OctetSequenceKey) {
239259
// build symmetric encrypters and decrypters
240260

241-
DirectEncrypter encrypter = new DirectEncrypter(((OctetSequenceKey) jwk).toByteArray());
242-
DirectDecrypter decrypter = new DirectDecrypter(((OctetSequenceKey) jwk).toByteArray());
261+
DirectEncrypter encrypter = new DirectEncrypter((OctetSequenceKey) jwk);
262+
encrypter.getJCAContext().setProvider(BouncyCastleProviderSingleton.getInstance());
263+
DirectDecrypter decrypter = new DirectDecrypter((OctetSequenceKey) jwk);
264+
decrypter.getJCAContext().setProvider(BouncyCastleProviderSingleton.getInstance());
243265

244266
encrypters.put(id, encrypter);
245267
decrypters.put(id, decrypter);

‎openid-connect-common/src/test/java/org/mitre/jwt/encryption/service/impl/TestDefaultJWTEncryptionAndDecryptionService.java‎

Lines changed: 50 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,24 @@
2323
import java.util.List;
2424
import java.util.Map;
2525

26+
import javax.crypto.Cipher;
27+
28+
import org.junit.Assume;
2629
import org.junit.Before;
30+
import org.junit.Rule;
2731
import org.junit.Test;
32+
import org.junit.rules.ExpectedException;
2833
import org.mitre.jose.keystore.JWKSetKeyStore;
34+
import org.slf4j.Logger;
35+
import org.slf4j.LoggerFactory;
2936

3037
import com.google.common.collect.ImmutableMap;
3138
import com.nimbusds.jose.EncryptionMethod;
3239
import com.nimbusds.jose.JOSEException;
3340
import com.nimbusds.jose.JWEAlgorithm;
3441
import com.nimbusds.jose.JWEHeader;
3542
import com.nimbusds.jose.JWEObject;
43+
import com.nimbusds.jose.jca.JCASupport;
3644
import com.nimbusds.jose.jwk.JWK;
3745
import com.nimbusds.jose.jwk.JWKSet;
3846
import com.nimbusds.jose.jwk.KeyUse;
@@ -57,14 +65,19 @@
5765
*/
5866

5967
public class TestDefaultJWTEncryptionAndDecryptionService {
68+
69+
private static Logger logger = LoggerFactory.getLogger(TestDefaultJWTEncryptionAndDecryptionService.class);
6070

6171
private String plainText = "The true sign of intelligence is not knowledge but imagination.";
6272

6373
private String issuer = "www.example.net";
6474
private String subject = "example_user";
6575
private JWTClaimsSet claimsSet = null;
76+
77+
@Rule
78+
public ExpectedException exception = ExpectedException.none();
6679

67-
// Example data taken from Mike Jones's draft-ietf-jose-json-web-encryption-14 appendix examples
80+
// Example data taken from rfc7516 appendix A
6881
private String compactSerializedJwe = "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ." +
6982
"OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe" +
7083
"ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb" +
@@ -167,9 +180,13 @@ public void prepare() throws NoSuchAlgorithmException, InvalidKeySpecException,
167180
}
168181

169182

170-
//@Test
171-
public void decrypt_RSA() throws ParseException {
183+
@Test
184+
public void decrypt_RSA() throws ParseException, NoSuchAlgorithmException {
172185

186+
Assume.assumeTrue(JCASupport.isSupported(JWEAlgorithm.RSA_OAEP) // check for algorithm support
187+
&& JCASupport.isSupported(EncryptionMethod.A256GCM)
188+
&& Cipher.getMaxAllowedKeyLength("RC5") >= 256); // check for unlimited crypto strength
189+
173190
service.setDefaultDecryptionKeyId(RSAkid);
174191
service.setDefaultEncryptionKeyId(RSAkid);
175192

@@ -184,9 +201,13 @@ public void decrypt_RSA() throws ParseException {
184201
}
185202

186203

187-
//@Test
188-
public void encryptThenDecrypt_RSA() throws ParseException {
204+
@Test
205+
public void encryptThenDecrypt_RSA() throws ParseException, NoSuchAlgorithmException {
189206

207+
Assume.assumeTrue(JCASupport.isSupported(JWEAlgorithm.RSA_OAEP) // check for algorithm support
208+
&& JCASupport.isSupported(EncryptionMethod.A256GCM)
209+
&& Cipher.getMaxAllowedKeyLength("RC5") >= 256); // check for unlimited crypto strength
210+
190211
service.setDefaultDecryptionKeyId(RSAkid);
191212
service.setDefaultEncryptionKeyId(RSAkid);
192213

@@ -212,9 +233,13 @@ public void encryptThenDecrypt_RSA() throws ParseException {
212233

213234

214235
// The same as encryptThenDecrypt_RSA() but relies on the key from the map
215-
//@Test
216-
public void encryptThenDecrypt_nullID() throws ParseException {
217-
236+
@Test
237+
public void encryptThenDecrypt_nullID() throws ParseException, NoSuchAlgorithmException {
238+
239+
Assume.assumeTrue(JCASupport.isSupported(JWEAlgorithm.RSA_OAEP) // check for algorithm support
240+
&& JCASupport.isSupported(EncryptionMethod.A256GCM)
241+
&& Cipher.getMaxAllowedKeyLength("RC5") >= 256); // check for unlimited crypto strength
242+
218243
service.setDefaultDecryptionKeyId(null);
219244
service.setDefaultEncryptionKeyId(null);
220245

@@ -239,9 +264,15 @@ public void encryptThenDecrypt_nullID() throws ParseException {
239264
}
240265

241266

242-
@Test(expected=IllegalStateException.class)
243-
public void encrypt_nullID_oneKey() {
267+
@Test
268+
public void encrypt_nullID_oneKey() throws NoSuchAlgorithmException {
269+
270+
Assume.assumeTrue(JCASupport.isSupported(JWEAlgorithm.RSA_OAEP) // check for algorithm support
271+
&& JCASupport.isSupported(EncryptionMethod.A256GCM)
272+
&& Cipher.getMaxAllowedKeyLength("RC5") >= 256); // check for unlimited crypto strength
244273

274+
exception.expect(IllegalStateException.class);
275+
245276
service_2.setDefaultEncryptionKeyId(null);
246277
assertEquals(null, service_2.getDefaultEncryptionKeyId());
247278

@@ -254,9 +285,16 @@ public void encrypt_nullID_oneKey() {
254285
}
255286

256287

257-
@Test(expected=IllegalStateException.class)
258-
public void decrypt_nullID() throws ParseException {
288+
@Test
289+
public void decrypt_nullID() throws ParseException, NoSuchAlgorithmException {
290+
291+
Assume.assumeTrue(JCASupport.isSupported(JWEAlgorithm.RSA_OAEP) // check for algorithm support
292+
&& JCASupport.isSupported(EncryptionMethod.A256GCM)
293+
&& Cipher.getMaxAllowedKeyLength("RC5") >= 256); // check for unlimited crypto strength
294+
259295

296+
exception.expect(IllegalStateException.class);
297+
260298
service_2.setDefaultEncryptionKeyId(RSAkid);
261299
service_2.setDefaultDecryptionKeyId(null);
262300

‎pom.xml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,11 @@
335335
<artifactId>javax.persistence</artifactId>
336336
<version>2.1.0</version>
337337
</dependency>
338+
<dependency>
339+
<groupId>com.zaxxer</groupId>
340+
<artifactId>HikariCP</artifactId>
341+
<version>2.4.1</version>
342+
</dependency>
338343

339344

340345
<!-- Logging -->
@@ -470,13 +475,12 @@
470475
<dependency>
471476
<groupId>com.nimbusds</groupId>
472477
<artifactId>nimbus-jose-jwt</artifactId>
473-
<version>4.2</version>
478+
<version>4.3</version>
474479
</dependency>
475-
476480
<dependency>
477-
<groupId>com.zaxxer</groupId>
478-
<artifactId>HikariCP</artifactId>
479-
<version>2.4.1</version>
481+
<groupId>org.bouncycastle</groupId>
482+
<artifactId>bcprov-jdk15on</artifactId>
483+
<version>[1.52,]</version>
480484
</dependency>
481485
</dependencies>
482486
</dependencyManagement>

0 commit comments

Comments
 (0)