Examples with ECKeyGenerator com.nimbusds.jose.jwk.gen.ECKeyGenerator used on opensource projects

Example 16 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class UserInfoServiceTest method createSignedAccessToken.

private AccessToken createSignedAccessToken(OIDCClaimsRequest identityClaims) throws JOSEException {
    var expiryDate = NowHelper.nowPlus(3, ChronoUnit.MINUTES);
    var ecSigningKey = new ECKeyGenerator(Curve.P_256).keyID(KEY_ID).algorithm(JWSAlgorithm.ES256).generate();
    var signer = new ECDSASigner(ecSigningKey);
    var signedJWT = TokenGeneratorHelper.generateSignedToken(CLIENT_ID, BASE_URL, SCOPES, signer, SUBJECT, ecSigningKey.getKeyID(), expiryDate, identityClaims);
    return new BearerAccessToken(signedJWT.serialize());
}

Example 17 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class TokenServiceTest method createSignedIdToken.

private void createSignedIdToken() throws JOSEException {
    ECKey ecSigningKey = new ECKeyGenerator(Curve.P_256).keyID(KEY_ID).algorithm(JWSAlgorithm.ES256).generate();
    ECDSASigner ecdsaSigner = new ECDSASigner(ecSigningKey);
    SignedJWT signedIdToken = createSignedIdToken(ecSigningKey);
    SignResult idTokenSignedResult = new SignResult();
    byte[] idTokenSignatureDer = ECDSA.transcodeSignatureToDER(signedIdToken.getSignature().decode());
    idTokenSignedResult.setSignature(ByteBuffer.wrap(idTokenSignatureDer));
    idTokenSignedResult.setKeyId(KEY_ID);
    idTokenSignedResult.setSigningAlgorithm(JWSAlgorithm.ES256.getName());
    when(kmsConnectionService.sign(any(SignRequest.class))).thenReturn(idTokenSignedResult);
}

Example 18 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class TokenServiceTest method createSignedAccessToken.

private void createSignedAccessToken() throws JOSEException {
    ECKey ecSigningKey = new ECKeyGenerator(Curve.P_256).keyID(KEY_ID).algorithm(JWSAlgorithm.ES256).generate();
    ECDSASigner signer = new ECDSASigner(ecSigningKey);
    SignedJWT signedJWT = TokenGeneratorHelper.generateSignedToken(CLIENT_ID, BASE_URL, SCOPES.toStringList(), signer, PUBLIC_SUBJECT, ecSigningKey.getKeyID());
    SignResult accessTokenResult = new SignResult();
    byte[] accessTokenSignatureDer = ECDSA.transcodeSignatureToDER(signedJWT.getSignature().decode());
    accessTokenResult.setSignature(ByteBuffer.wrap(accessTokenSignatureDer));
    accessTokenResult.setKeyId(KEY_ID);
    accessTokenResult.setSigningAlgorithm(JWSAlgorithm.ES256.getName());
    when(kmsConnectionService.sign(any(SignRequest.class))).thenReturn(accessTokenResult);
}

Example 19 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class ConfigurationServiceTest method getDocAppCredentialSigningPublicKeyShouldGetECPublicKeyObjectFromParameterStorePEM.

@Test
void getDocAppCredentialSigningPublicKeyShouldGetECPublicKeyObjectFromParameterStorePEM() throws JOSEException {
    var privateKey = new ECKeyGenerator(Curve.P_256).keyID("my-key-id").generate();
    var publicKey = privateKey.toPublicJWK();
    var pem = publicKeyToPem(publicKey);
    var ssmClient = mock(AWSSimpleSystemsManagement.class);
    var request = new GetParameterRequest().withWithDecryption(true).withName("test-doc-app-public-signing-key");
    when(ssmClient.getParameter(eq(request))).thenReturn(new GetParameterResult().withParameter(new Parameter().withName("test-doc-app-public-signing-key").withValue(pem)));
    ConfigurationService configurationService = new ConfigurationService(ssmClient);
    var result = configurationService.getDocAppCredentialSigningPublicKey();
    assertThat(result, equalTo(publicKey.toECPublicKey(new BouncyCastleProvider())));
}

Example 20 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class DocAppAuthorisationServiceTest method shouldConstructASignedRequestJWT.

@Test
void shouldConstructASignedRequestJWT() throws JOSEException, ParseException {
    var ecSigningKey = new ECKeyGenerator(Curve.P_256).keyID(KEY_ID).algorithm(JWSAlgorithm.ES256).generate();
    var ecdsaSigner = new ECDSASigner(ecSigningKey);
    var jwtClaimsSet = new JWTClaimsSet.Builder().build();
    var jwsHeader = new JWSHeader(JWSAlgorithm.ES256);
    var signedJWT = new SignedJWT(jwsHeader, jwtClaimsSet);
    signedJWT.sign(ecdsaSigner);
    var signResult = new SignResult();
    byte[] signatureToDER = ECDSA.transcodeSignatureToDER(signedJWT.getSignature().decode());
    signResult.setSignature(ByteBuffer.wrap(signatureToDER));
    signResult.setKeyId(KEY_ID);
    signResult.setSigningAlgorithm(JWSAlgorithm.ES256.getName());
    when(kmsConnectionService.sign(any(SignRequest.class))).thenReturn(signResult);
    var state = new State();
    var pairwise = new Subject("pairwise-identifier");
    var encryptedJWT = authorisationService.constructRequestJWT(state, pairwise);
    var signedJWTResponse = decryptJWT(encryptedJWT);
    assertThat(signedJWTResponse.getJWTClaimsSet().getClaim("client_id"), equalTo(DOC_APP_CLIENT_ID));
    assertThat(signedJWTResponse.getJWTClaimsSet().getClaim("state"), equalTo(state.getValue()));
    assertThat(signedJWTResponse.getJWTClaimsSet().getSubject(), equalTo(pairwise.getValue()));
    assertThat(signedJWTResponse.getJWTClaimsSet().getIssuer(), equalTo(DOC_APP_CLIENT_ID));
    assertThat(signedJWTResponse.getJWTClaimsSet().getAudience(), equalTo(singletonList(DOC_APP_AUTHORISATION_URI.toString())));
    assertThat(signedJWTResponse.getJWTClaimsSet().getClaim("response_type"), equalTo("code"));
}