Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Infer the JWS signing algorithm name by looking at the provided key #247

Merged
merged 4 commits into from
Apr 15, 2024
Merged

Infer the JWS signing algorithm name by looking at the provided key #247

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b264d29
Infer the JWS signing algorithm name by looking at the provided key
erik-h Apr 12, 2024
37e4382
Fix linter issues
erik-h Apr 15, 2024
a44ea63
Add comment re: why key algorithm inference is necessary
erik-h Apr 15, 2024
03ec224
Add comment in test re: key algorithm inference
erik-h Apr 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion internal/authz/oidc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -621,7 +621,7 @@ func (o *oidcHandler) isValidIDToken(ctx context.Context, log telemetry.Logger,
return false, codes.Internal
}

if _, err := jws.Verify([]byte(idTokenString), jws.WithKeySet(jwtSet)); err != nil {
if _, err := jws.Verify([]byte(idTokenString), jws.WithKeySet(jwtSet, jws.WithInferAlgorithmFromKey(true))); err != nil {
nacx marked this conversation as resolved.
Show resolved Hide resolved
log.Error("error verifying id token with fetched jwks", err)
return false, codes.Internal
}
Expand Down
29 changes: 26 additions & 3 deletions internal/authz/oidc_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,12 @@

unknownJWKPriv, _ := newKeyPair(t)
jwkPriv, jwkPub := newKeyPair(t)
bytes, err := json.Marshal(newKeySet(t, jwkPub))
noAlgJwkPriv, noAlgJwkPub := newKeyPair(t)
noAlgJwkPriv.Set(jwk.KeyIDKey, noAlgKeyId)

Check failure on line 198 in internal/authz/oidc_test.go

View workflow job for this annotation

GitHub Actions / lint 

Error return value of `noAlgJwkPriv.Set` is not checked (errcheck)
noAlgJwkPub.Set(jwk.KeyIDKey, noAlgKeyId)

Check failure on line 199 in internal/authz/oidc_test.go

View workflow job for this annotation

GitHub Actions / lint 

Error return value of `noAlgJwkPub.Set` is not checked (errcheck)
noAlgJwkPub.Remove(jwk.AlgorithmKey)

Check failure on line 200 in internal/authz/oidc_test.go

View workflow job for this annotation

GitHub Actions / lint 

Error return value of `noAlgJwkPub.Remove` is not checked (errcheck)

bytes, err := json.Marshal(newKeySet(t, jwkPub, noAlgJwkPub))
require.NoError(t, err)
basicOIDCConfig.JwksConfig = &oidcv1.OIDCConfig_Jwks{
Jwks: string(bytes),
Expand Down Expand Up @@ -360,6 +365,23 @@
requireStoredTokens(t, store, newSessionID, false)
},
},
{
name: "successfully retrieve new tokens when 'alg' is not specified in JWK",
req: callbackRequest,
storedAuthState: validAuthState,
mockTokensResponse: &idpTokensResponse{
IDToken: newJWT(t, noAlgJwkPriv, jwt.NewBuilder().Audience([]string{"test-client-id"}).Claim("nonce", newNonce)),
AccessToken: "access-token",
TokenType: "Bearer",
},
responseVerify: func(t *testing.T, resp *envoy.CheckResponse) {
require.Equal(t, int32(codes.Unauthenticated), resp.GetStatus().GetCode())
requireStandardResponseHeaders(t, resp)
requireRedirectResponse(t, resp.GetDeniedResponse(), requestedAppURL, nil)
requireStoredTokens(t, store, sessionID, true)
requireStoredTokens(t, store, newSessionID, false)
},
},
{
name: "request is invalid, query parameters are missing",
req: modifyCallbackRequestPath("/callback?"),
Expand Down Expand Up @@ -1405,8 +1427,9 @@
}

const (
keyID = "test"
keyAlg = jwa.RS256
keyID = "test"
keyAlg = jwa.RS256
noAlgKeyId = "noAlgTest"

Check failure on line 1432 in internal/authz/oidc_test.go

View workflow job for this annotation

GitHub Actions / lint 

var-naming: const noAlgKeyId should be noAlgKeyID (revive)
)

func newKeySet(t *testing.T, keys ...jwk.Key) jwk.Set {
Expand Down
Loading