Examples with SignatureAlgorithm org.apache.cxf.rs.security.jose.jwa.SignatureAlgorithm used on opensource projects

Example 1 with SignatureAlgorithm

use of org.apache.cxf.rs.security.jose.jwa.SignatureAlgorithm in project cxf by apache.

the class OidcImplicitService method processIdToken.

protected String processIdToken(OAuthRedirectionState state, IdToken idToken) {
    OAuthJoseJwtProducer processor = idTokenHandler == null ? new OAuthJoseJwtProducer() : idTokenHandler;
    String code = (String) JAXRSUtils.getCurrentMessage().getExchange().get(OAuthConstants.AUTHORIZATION_CODE_VALUE);
    if (code != null) {
        // this service is invoked as part of the hybrid flow
        Properties props = JwsUtils.loadSignatureOutProperties(false);
        SignatureAlgorithm sigAlgo = null;
        if (processor.isSignWithClientSecret()) {
            sigAlgo = OAuthUtils.getClientSecretSignatureAlgorithm(props);
        } else {
            sigAlgo = JwsUtils.getSignatureAlgorithm(props, SignatureAlgorithm.RS256);
        }
        idToken.setAuthorizationCodeHash(OidcUtils.calculateAuthorizationCodeHash(code, sigAlgo));
    }
    idToken.setNonce(state.getNonce());
    return processor.processJwt(new JwtToken(idToken));
}

Example 2 with SignatureAlgorithm

use of org.apache.cxf.rs.security.jose.jwa.SignatureAlgorithm in project cxf by apache.

the class JwsUtils method getJwsJsonSignatureMap.

public static Map<SignatureAlgorithm, List<JwsJsonSignatureEntry>> getJwsJsonSignatureMap(List<JwsJsonSignatureEntry> signatures) {
    Map<SignatureAlgorithm, List<JwsJsonSignatureEntry>> map = new HashMap<>();
    for (JwsJsonSignatureEntry entry : signatures) {
        SignatureAlgorithm sigAlgorithm = entry.getUnionHeader().getSignatureAlgorithm();
        List<JwsJsonSignatureEntry> entries = map.get(sigAlgorithm);
        if (entries == null) {
            entries = new ArrayList<>();
        }
        entries.add(entry);
        map.put(sigAlgorithm, entries);
    }
    return map;
}

Example 3 with SignatureAlgorithm

use of org.apache.cxf.rs.security.jose.jwa.SignatureAlgorithm in project cxf by apache.

the class JwsUtils method getSignatureProvider.

public static JwsSignatureProvider getSignatureProvider(JsonWebKey jwk, SignatureAlgorithm defaultAlgorithm) {
    SignatureAlgorithm sigAlgo = jwk.getAlgorithm() == null ? defaultAlgorithm : SignatureAlgorithm.getAlgorithm(jwk.getAlgorithm());
    JwsSignatureProvider theSigProvider = null;
    KeyType keyType = jwk.getKeyType();
    if (KeyType.RSA == keyType) {
        theSigProvider = getPrivateKeySignatureProvider(JwkUtils.toRSAPrivateKey(jwk), sigAlgo);
    } else if (KeyType.OCTET == keyType) {
        byte[] key = JoseUtils.decode((String) jwk.getProperty(JsonWebKey.OCTET_KEY_VALUE));
        theSigProvider = getHmacSignatureProvider(key, sigAlgo);
    } else if (KeyType.EC == jwk.getKeyType()) {
        theSigProvider = getPrivateKeySignatureProvider(JwkUtils.toECPrivateKey(jwk), sigAlgo);
    }
    return theSigProvider;
}

Example 4 with SignatureAlgorithm

use of org.apache.cxf.rs.security.jose.jwa.SignatureAlgorithm in project cxf by apache.

the class JwsUtils method loadSignatureProvider.

public static JwsSignatureProvider loadSignatureProvider(Message m, Properties props, JwsHeaders headers) {
    JwsSignatureProvider theSigProvider = null;
    boolean includeCert = JoseUtils.checkBooleanProperty(headers, props, m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_CERT);
    boolean includeCertSha1 = JoseUtils.checkBooleanProperty(headers, props, m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_CERT_SHA1);
    boolean includeCertSha256 = JoseUtils.checkBooleanProperty(headers, props, m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_CERT_SHA256);
    boolean includeKeyId = JoseUtils.checkBooleanProperty(headers, props, m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_KEY_ID);
    if (JoseConstants.HEADER_JSON_WEB_KEY.equals(props.get(JoseConstants.RSSEC_KEY_STORE_TYPE))) {
        JsonWebKey jwk = JwkUtils.loadJsonWebKey(m, props, KeyOperation.SIGN);
        if (jwk != null) {
            SignatureAlgorithm signatureAlgo = getSignatureAlgorithm(m, props, SignatureAlgorithm.getAlgorithm(jwk.getAlgorithm()), getDefaultKeyAlgorithm(jwk));
            theSigProvider = JwsUtils.getSignatureProvider(jwk, signatureAlgo);
            boolean includePublicKey = JoseUtils.checkBooleanProperty(headers, props, m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_PUBLIC_KEY);
            if (includeCert) {
                JwkUtils.includeCertChain(jwk, headers, signatureAlgo.getJwaName());
            }
            if (includeCertSha1) {
                KeyManagementUtils.setSha1DigestHeader(headers, m, props);
            } else if (includeCertSha256) {
                KeyManagementUtils.setSha256DigestHeader(headers, m, props);
            }
            if (includePublicKey) {
                JwkUtils.includePublicKey(jwk, headers, signatureAlgo.getJwaName());
            }
            if (includeKeyId && jwk.getKeyId() != null) {
                headers.setKeyId(jwk.getKeyId());
            }
        }
    } else {
        SignatureAlgorithm signatureAlgo = getSignatureAlgorithm(m, props, null, null);
        if (signatureAlgo == SignatureAlgorithm.NONE) {
            theSigProvider = new NoneJwsSignatureProvider();
        } else {
            PrivateKey pk = KeyManagementUtils.loadPrivateKey(m, props, KeyOperation.SIGN);
            if (signatureAlgo == null) {
                signatureAlgo = getDefaultPrivateKeyAlgorithm(pk);
            }
            theSigProvider = getPrivateKeySignatureProvider(pk, signatureAlgo);
            if (includeCert) {
                headers.setX509Chain(KeyManagementUtils.loadAndEncodeX509CertificateOrChain(m, props));
            }
            if (includeCertSha1) {
                KeyManagementUtils.setSha1DigestHeader(headers, m, props);
            } else if (includeCertSha256) {
                KeyManagementUtils.setSha256DigestHeader(headers, m, props);
            }
            if (includeKeyId && props.containsKey(JoseConstants.RSSEC_KEY_STORE_ALIAS)) {
                headers.setKeyId(props.getProperty(JoseConstants.RSSEC_KEY_STORE_ALIAS));
            }
        }
    }
    if (theSigProvider == null) {
        LOG.warning("Provider is not available");
        throw new JwsException(JwsException.Error.NO_PROVIDER);
    }
    return theSigProvider;
}

Example 5 with SignatureAlgorithm

use of org.apache.cxf.rs.security.jose.jwa.SignatureAlgorithm in project cxf by apache.

the class AbstractJwtAuthenticationFilter method isVerifiedWithAPublicKey.

private boolean isVerifiedWithAPublicKey(JwtToken jwt) {
    if (isJwsRequired()) {
        String alg = (String) jwt.getJwsHeader(JoseConstants.HEADER_ALGORITHM);
        SignatureAlgorithm sigAlg = SignatureAlgorithm.getAlgorithm(alg);
        return SignatureAlgorithm.isPublicKeyAlgorithm(sigAlg);
    }
    return false;
}