Update OAuth2 OIDC SDK

gradle/verification-metadata.xml

@@ -881,21 +881,33 @@
             <sha256 value="e49d2c694bb80c7036c177f2aabf53b7156061a68bd19dfd60e2bd370709e0c5" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.nimbusds" name="lang-tag" version="1.7">
+         <artifact name="lang-tag-1.7.jar">
+            <sha256 value="e8c1c594e2425bdbea2d860de55c69b69fc5d59454452449a0f0913c2a5b8a31" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.nimbusds" name="nimbus-jose-jwt" version="4.41.1">
          <artifact name="nimbus-jose-jwt-4.41.1.jar">
             <sha256 value="fbfd0d5f2b2f86758b821daa5e79b5d7c965edd9dc1b2cc80b515df1c6ddc22d" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.nimbusds" name="nimbus-jose-jwt" version="9.23">
-         <artifact name="nimbus-jose-jwt-9.23.jar">
-            <sha256 value="33ab8084fdae1d75be1b061b1489d4a12045bd7b50c2e24ff152911e4551ec07" origin="Generated by Gradle"/>
+      <component group="com.nimbusds" name="nimbus-jose-jwt" version="9.39">
+         <artifact name="nimbus-jose-jwt-9.39.jar">
+            <sha256 value="33ab8084fdae1d75be1b061b1489d4a12045bd7b50c2e24ff152911e4551ec07" origin="Generated by Gradle">
+               <also-trust value="b5ac8298f7d8b115ea1e1d622f38d45cd07d8088f648153ebf35573ca42ee252"/>
+            </sha256>
          </artifact>
       </component>
       <component group="com.nimbusds" name="nimbus-jose-jwt" version="9.8.1">
          <artifact name="nimbus-jose-jwt-9.8.1.jar">
             <sha256 value="7664cf8c6f2adadf600287812b32878277beda54912eab9d4c2932cd50cb704a" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.nimbusds" name="oauth2-oidc-sdk" version="11.10.1">
+         <artifact name="oauth2-oidc-sdk-11.10.1.jar">
+            <sha256 value="9e51b2c17503cdd3eb97f41491c712aff7783bb3c67185d789f44ccf2a603b26" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.nimbusds" name="oauth2-oidc-sdk" version="9.37">
          <artifact name="oauth2-oidc-sdk-9.37.jar">
             <sha256 value="44a04bbed5ae3f6d198aa73ee6b545c476e528ec1a267ef3e9f7033f886dd6fe" origin="Generated by Gradle"/>
@@ -1654,6 +1666,11 @@
             <sha256 value="64072f56d9dff5040b2acec477c5d5e6bcebfc88c508f12acb26072d07942146" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="net.minidev" name="json-smart" version="2.5.1">
+         <artifact name="json-smart-2.5.1.jar">
+            <sha256 value="86c0c189581b79b57b0719f443a724e9f628ffbb9eef645cf79194f5973a1001" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="net.nextencia" name="rrdiagram" version="0.9.4">
          <artifact name="rrdiagram-0.9.4.jar">
             <sha256 value="8f0855addca5320cfadedbf7d3d46b681f3f308b6e87d5d82f32637ba72256b6" origin="Generated by Gradle"/>

x-pack/plugin/core/build.gradle

@@ -51,7 +51,7 @@ dependencies {
 
   // security deps
   api 'com.unboundid:unboundid-ldapsdk:6.0.3'
-  api "com.nimbusds:nimbus-jose-jwt:9.23"
+  api "com.nimbusds:nimbus-jose-jwt:9.39"
 
   implementation project(":x-pack:plugin:core:template-resources")
 
@@ -128,34 +128,34 @@ sourceSets.test.resources {
 
 tasks.named("thirdPartyAudit").configure {
   ignoreMissingClasses(
-    //commons-logging optional dependencies
-    'org.apache.avalon.framework.logger.Logger',
-    'org.apache.log.Hierarchy',
-    'org.apache.log.Logger',
-    //commons-logging provided dependencies
-    'javax.servlet.ServletContextEvent',
-    'javax.servlet.ServletContextListener',
-    'javax.jms.Message',
-    // Optional dependency of nimbus-jose-jwt for handling Ed25519 signatures and ECDH with X25519 (RFC 8037)
-    'com.google.crypto.tink.subtle.Ed25519Sign',
-    'com.google.crypto.tink.subtle.Ed25519Sign$KeyPair',
-    'com.google.crypto.tink.subtle.Ed25519Verify',
-    'com.google.crypto.tink.subtle.X25519',
-    'com.google.crypto.tink.subtle.XChaCha20Poly1305',
-    // optional dependencies for nimbus-jose-jwt
-    'org.bouncycastle.asn1.pkcs.PrivateKeyInfo',
-    'org.bouncycastle.asn1.x509.AlgorithmIdentifier',
-    'org.bouncycastle.asn1.x509.SubjectPublicKeyInfo',
-    'org.bouncycastle.cert.X509CertificateHolder',
-    'org.bouncycastle.cert.jcajce.JcaX509CertificateHolder',
-    'org.bouncycastle.crypto.InvalidCipherTextException',
-    'org.bouncycastle.crypto.engines.AESEngine',
-    'org.bouncycastle.crypto.modes.GCMBlockCipher',
-    'org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider',
-    'org.bouncycastle.jce.provider.BouncyCastleProvider',
-    'org.bouncycastle.openssl.PEMKeyPair',
-    'org.bouncycastle.openssl.PEMParser',
-    'org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter'
+          //commons-logging optional dependencies
+          'org.apache.avalon.framework.logger.Logger',
+          'org.apache.log.Hierarchy',
+          'org.apache.log.Logger',
+          //commons-logging provided dependencies
+          'javax.servlet.ServletContextEvent',
+          'javax.servlet.ServletContextListener',
+          'javax.jms.Message',
+          // Optional dependency of nimbus-jose-jwt for handling Ed25519 signatures and ECDH with X25519 (RFC 8037)
+          'com.google.crypto.tink.subtle.Ed25519Sign',
+          'com.google.crypto.tink.subtle.Ed25519Sign$KeyPair',
+          'com.google.crypto.tink.subtle.Ed25519Verify',
+          'com.google.crypto.tink.subtle.X25519',
+          'com.google.crypto.tink.subtle.XChaCha20Poly1305',
+          // optional dependencies for nimbus-jose-jwt
+          'org.bouncycastle.asn1.pkcs.PrivateKeyInfo',
+          'org.bouncycastle.asn1.x509.AlgorithmIdentifier',
+          'org.bouncycastle.asn1.x509.SubjectPublicKeyInfo',
+          'org.bouncycastle.cert.X509CertificateHolder',
+          'org.bouncycastle.cert.jcajce.JcaX509CertificateHolder',
+//          'org.bouncycastle.crypto.InvalidCipherTextException',
+//          'org.bouncycastle.crypto.engines.AESEngine',
+//          'org.bouncycastle.crypto.modes.GCMBlockCipher',
+//          'org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider',
+//          'org.bouncycastle.jce.provider.BouncyCastleProvider',
+          'org.bouncycastle.openssl.PEMKeyPair',
+          'org.bouncycastle.openssl.PEMParser',
+          'org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter'
   )
 }
 

x-pack/plugin/core/src/main/java/module-info.java

@@ -22,7 +22,6 @@
     requires unboundid.ldapsdk;
     requires org.elasticsearch.tdigest;
     requires org.elasticsearch.xcore.templates;
-    requires com.nimbusds.jose.jwt;
 
     exports org.elasticsearch.index.engine.frozen;
     exports org.elasticsearch.license;

x-pack/plugin/security/build.gradle

@@ -79,12 +79,12 @@ dependencies {
   runtimeOnly "joda-time:joda-time:2.10.10"
 
   // Dependencies for oidc
-  api "com.nimbusds:oauth2-oidc-sdk:9.37"
-  api "com.nimbusds:nimbus-jose-jwt:9.23"
-  api "com.nimbusds:lang-tag:1.4.4"
+  api "com.nimbusds:oauth2-oidc-sdk:11.10.1"
+  api "com.nimbusds:nimbus-jose-jwt:9.39"
+  api "com.nimbusds:lang-tag:1.7"
   api "com.sun.mail:jakarta.mail:1.6.3"
   api "net.jcip:jcip-annotations:1.0"
-  api "net.minidev:json-smart:2.4.10"
+  api "net.minidev:json-smart:2.5.1"
   api "net.minidev:accessors-smart:2.4.2"
   api "org.ow2.asm:asm:8.0.1"
 
@@ -103,7 +103,7 @@ dependencies {
   testImplementation('org.apache.kerby:kerb-crypto:1.1.1')
   testImplementation('org.apache.kerby:kerb-util:1.1.1')
   testImplementation('org.apache.kerby:token-provider:1.1.1')
-  testImplementation('com.nimbusds:nimbus-jose-jwt:9.23')
+  testImplementation('com.nimbusds:nimbus-jose-jwt:9.39')
   testImplementation('net.jcip:jcip-annotations:1.0')
   testImplementation('org.apache.kerby:kerb-admin:1.1.1')
   testImplementation('org.apache.kerby:kerb-server:1.1.1')
@@ -225,6 +225,9 @@ tasks.named("thirdPartyAudit").configure {
     'javax.servlet.http.HttpSession',
     'javax.servlet.http.HttpUpgradeHandler',
     'javax.servlet.http.Part',
+    'jakarta.servlet.ServletRequest',
+    'jakarta.servlet.http.HttpServletRequest',
+    'jakarta.servlet.http.HttpServletResponse',
     // [missing classes] Shibboleth + OpenSAML have velocity support that we don't use
     'org.apache.velocity.VelocityContext',
     'org.apache.velocity.app.VelocityEngine',
@@ -325,14 +328,14 @@ tasks.named("thirdPartyAudit").configure {
         'org.bouncycastle.crypto.StreamCipher',
         'org.bouncycastle.crypto.agreement.kdf.ConcatenationKDFGenerator',
         // 'org.bouncycastle.crypto.ec.CustomNamedCurves',
-        'org.bouncycastle.crypto.engines.AESEngine',
+//        'org.bouncycastle.crypto.engines.AESEngine',
         'org.bouncycastle.crypto.generators.BCrypt',
         'org.bouncycastle.crypto.generators.OpenSSLPBEParametersGenerator',
         'org.bouncycastle.crypto.generators.PKCS5S1ParametersGenerator',
         'org.bouncycastle.crypto.generators.PKCS5S2ParametersGenerator',
         'org.bouncycastle.crypto.macs.HMac',
         'org.bouncycastle.crypto.modes.AEADBlockCipher',
-        'org.bouncycastle.crypto.modes.GCMBlockCipher',
+//        'org.bouncycastle.crypto.modes.GCMBlockCipher',
         'org.bouncycastle.crypto.paddings.BlockCipherPadding',
         'org.bouncycastle.crypto.paddings.PaddedBufferedBlockCipher',
         'org.bouncycastle.crypto.params.AsymmetricKeyParameter',
@@ -373,13 +376,13 @@ tasks.named("thirdPartyAudit").configure {
         'org.bouncycastle.util.Arrays',
         'org.bouncycastle.util.io.Streams',
         'org.bouncycastle.cert.jcajce.JcaX509CertificateHolder',
-        'org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider',
+//        'org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider',
         'org.bouncycastle.cert.X509CertificateHolder',
         'org.bouncycastle.openssl.PEMKeyPair',
         'org.bouncycastle.openssl.PEMParser',
         'org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter',
-        'org.bouncycastle.crypto.InvalidCipherTextException',
-        'org.bouncycastle.jce.provider.BouncyCastleProvider',
+//        'org.bouncycastle.crypto.InvalidCipherTextException',
+//        'org.bouncycastle.jce.provider.BouncyCastleProvider',
   )
 
   ignoreViolations(
@@ -416,6 +419,7 @@ tasks.named("thirdPartyAudit").configure {
           'com.google.crypto.tink.subtle.X25519',
           'com.google.crypto.tink.subtle.XChaCha20Poly1305',
           'com.nimbusds.common.contenttype.ContentType',
+          'com.nimbusds.common.contenttype.ContentType$Parameter',
           'javax.activation.ActivationDataFlavor',
           'javax.activation.DataContentHandler',
           'javax.activation.DataHandler',

x-pack/plugin/security/src/main/java/module-info.java

@@ -38,7 +38,6 @@
     requires org.opensaml.xmlsec.impl;
     requires org.opensaml.xmlsec;
 
-    requires com.nimbusds.jose.jwt;
     requires io.netty.common;
     requires io.netty.codec.http;
     requires io.netty.handler;
@@ -49,6 +48,7 @@
     requires oauth2.oidc.sdk;
     requires org.slf4j;
     requires unboundid.ldapsdk;
+    // requires com.nimbusds.jose.jwt;
 
     exports org.elasticsearch.xpack.security.action to org.elasticsearch.server;
     exports org.elasticsearch.xpack.security.action.apikey to org.elasticsearch.server;

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/jwt/JwtAuthenticator.java

@@ -13,6 +13,7 @@
 
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.elasticsearch.SpecialPermission;
 import org.elasticsearch.action.ActionListener;
 import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.core.Nullable;
@@ -23,6 +24,8 @@
 import org.elasticsearch.xpack.core.security.authc.jwt.JwtRealmSettings;
 import org.elasticsearch.xpack.core.ssl.SSLService;
 
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.time.Clock;
 import java.util.ArrayList;
 import java.util.List;
@@ -66,6 +69,15 @@ public JwtAuthenticator(
     }
 
     public void authenticate(JwtAuthenticationToken jwtAuthenticationToken, ActionListener<JWTClaimsSet> listener) {
+        // nimbus-jose-jwt uses reflection under the hood
+        SpecialPermission.check();
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+            doAuthenticate(jwtAuthenticationToken, listener);
+            return null;
+        });
+    }
+
+    private void doAuthenticate(JwtAuthenticationToken jwtAuthenticationToken, ActionListener<JWTClaimsSet> listener) {
         final String tokenPrincipal = jwtAuthenticationToken.principal();
         // JWT cache
         final SignedJWT signedJWT = jwtAuthenticationToken.getSignedJWT();

x-pack/plugin/security/src/main/plugin-metadata/plugin-security.codebases

@@ -1,2 +1,4 @@
 netty-common: io.netty.util.NettyRuntime
 netty-transport: io.netty.channel.Channel
+oauth2-oidc-sdk: com.nimbusds.jose.shaded.gson.internal.ConstructorConstructor
+nimbus-jose-jwt:

x-pack/plugin/security/src/main/plugin-metadata/plugin-security.policy

@@ -10,6 +10,11 @@ grant {
   // which uses it in the opensaml-xmlsec-impl
   permission java.security.SecurityPermission "org.apache.xml.security.register";
 
+  // gson, as included & shaded by nimbus. I think these can be moved out
+  permission java.lang.RuntimePermission "accessDeclaredMembers";
+  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
+
+
   // needed for multiple server implementations used in tests
   permission java.net.SocketPermission "*", "accept,connect";
 
@@ -45,3 +50,15 @@ grant codeBase "${codebase.netty-transport}" {
    // the bug says it only happened rarely, and that its fixed, but apparently it still happens rarely!
    permission java.util.PropertyPermission "sun.nio.ch.bugLevel", "write";
 };
+
+grant codeBase "${codebase.oauth2-oidc-sdk}" {
+    // for JSON serialization based on a shaded GSON dependency
+    permission java.lang.RuntimePermission "accessDeclaredMembers";
+    permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
+};
+
+grant codeBase "${codebase.nimbus-jose-jwt}" {
+    // for JSON serialization based on a shaded GSON dependency
+    permission java.lang.RuntimePermission "accessDeclaredMembers";
+    permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
+};

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/oidc/OpenIdConnectTestCase.java

@@ -6,12 +6,13 @@
  */
 package org.elasticsearch.xpack.security.authc.oidc;
 
+import net.minidev.json.JSONStyle;
+import net.minidev.json.JSONValue;
+import net.minidev.json.reader.JsonWriterI;
+
 import com.nimbusds.jose.JWSAlgorithm;
 import com.nimbusds.jose.JWSHeader;
 import com.nimbusds.jose.crypto.RSASSASigner;
-import com.nimbusds.jose.shaded.json.JSONStyle;
-import com.nimbusds.jose.shaded.json.JSONValue;
-import com.nimbusds.jose.shaded.json.reader.JsonWriterI;
 import com.nimbusds.jwt.JWT;
 import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.jwt.SignedJWT;