Examples with KeyWrapper org.keycloak.crypto.KeyWrapper used on opensource projects

Example 6 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class PublicKeyStorageManager method getClientPublicKey.

public static PublicKey getClientPublicKey(KeycloakSession session, ClientModel client, JWSInput input) {
    KeyWrapper keyWrapper = getClientPublicKeyWrapper(session, client, input);
    PublicKey publicKey = null;
    if (keyWrapper != null) {
        publicKey = (PublicKey) keyWrapper.getPublicKey();
    }
    return publicKey;
}

Example 7 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class TestingOIDCEndpointsApplicationResource method setOidcRequest.

private void setOidcRequest(Object oidcRequest, String jwaAlgorithm, String clientSecret) {
    if (!isSupportedAlgorithm(jwaAlgorithm))
        throw new BadRequestException("Unknown argument: " + jwaAlgorithm);
    if ("none".equals(jwaAlgorithm)) {
        clientData.setOidcRequest(new JWSBuilder().jsonContent(oidcRequest).none());
    } else {
        SignatureSignerContext signer;
        switch(jwaAlgorithm) {
            case Algorithm.HS256:
            case Algorithm.HS384:
            case Algorithm.HS512:
                KeyWrapper keyWrapper = new KeyWrapper();
                SecretKey secretKey = new SecretKeySpec(clientSecret.getBytes(StandardCharsets.UTF_8), JavaAlgorithm.getJavaAlgorithm(jwaAlgorithm));
                keyWrapper.setSecretKey(secretKey);
                String kid = KeyUtils.createKeyId(secretKey);
                keyWrapper.setKid(kid);
                keyWrapper.setAlgorithm(jwaAlgorithm);
                keyWrapper.setUse(KeyUse.SIG);
                keyWrapper.setType(KeyType.OCT);
                signer = new MacSignatureSignerContext(keyWrapper);
                clientData.setOidcRequest(new JWSBuilder().kid(kid).jsonContent(oidcRequest).sign(signer));
                break;
            default:
                throw new BadRequestException("Unknown jwaAlgorithm: " + jwaAlgorithm);
        }
    }
}

Example 8 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class ClientPublicKeyLoader method loadKeys.

@Override
public Map<String, KeyWrapper> loadKeys() throws Exception {
    OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientModel(client);
    if (config.isUseJwksUrl()) {
        String jwksUrl = config.getJwksUrl();
        jwksUrl = ResolveRelative.resolveRelativeUri(session, client.getRootUrl(), jwksUrl);
        JSONWebKeySet jwks = JWKSHttpUtils.sendJwksRequest(session, jwksUrl);
        return JWKSUtils.getKeyWrappersForUse(jwks, keyUse);
    } else if (config.isUseJwksString()) {
        JSONWebKeySet jwks = JsonSerialization.readValue(config.getJwksString(), JSONWebKeySet.class);
        return JWKSUtils.getKeyWrappersForUse(jwks, keyUse);
    } else if (keyUse == JWK.Use.SIG) {
        try {
            CertificateRepresentation certInfo = CertificateInfoHelper.getCertificateFromClient(client, JWTClientAuthenticator.ATTR_PREFIX);
            KeyWrapper publicKey = getSignatureValidationKey(certInfo);
            return Collections.singletonMap(publicKey.getKid(), publicKey);
        } catch (ModelException me) {
            logger.warnf(me, "Unable to retrieve publicKey for verify signature of client '%s' . Error details: %s", client.getClientId(), me.getMessage());
            return Collections.emptyMap();
        }
    } else {
        logger.warnf("Unable to retrieve publicKey of client '%s' for the specified purpose other than verifying signature", client.getClientId());
        return Collections.emptyMap();
    }
}

Example 9 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class ClientPublicKeyLoader method getSignatureValidationKey.

private static KeyWrapper getSignatureValidationKey(CertificateRepresentation certInfo) throws ModelException {
    KeyWrapper keyWrapper = new KeyWrapper();
    String encodedCertificate = certInfo.getCertificate();
    String encodedPublicKey = certInfo.getPublicKey();
    if (encodedCertificate == null && encodedPublicKey == null) {
        throw new ModelException("Client doesn't have certificate or publicKey configured");
    }
    if (encodedCertificate != null && encodedPublicKey != null) {
        throw new ModelException("Client has both publicKey and certificate configured");
    }
    keyWrapper.setAlgorithm(Algorithm.RS256);
    keyWrapper.setType(KeyType.RSA);
    keyWrapper.setUse(KeyUse.SIG);
    String kid = null;
    if (encodedCertificate != null) {
        X509Certificate clientCert = KeycloakModelUtils.getCertificate(encodedCertificate);
        // Check if we have kid in DB, generate otherwise
        kid = certInfo.getKid() != null ? certInfo.getKid() : KeyUtils.createKeyId(clientCert.getPublicKey());
        keyWrapper.setKid(kid);
        keyWrapper.setPublicKey(clientCert.getPublicKey());
        keyWrapper.setCertificate(clientCert);
    } else {
        PublicKey publicKey = KeycloakModelUtils.getPublicKey(encodedPublicKey);
        // Check if we have kid in DB, generate otherwise
        kid = certInfo.getKid() != null ? certInfo.getKid() : KeyUtils.createKeyId(publicKey);
        keyWrapper.setKid(kid);
        keyWrapper.setPublicKey(publicKey);
    }
    return keyWrapper;
}

Example 10 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class OIDCIdentityProviderPublicKeyLoader method loadKeys.

@Override
public Map<String, KeyWrapper> loadKeys() throws Exception {
    if (config.isUseJwksUrl()) {
        String jwksUrl = config.getJwksUrl();
        JSONWebKeySet jwks = JWKSHttpUtils.sendJwksRequest(session, jwksUrl);
        return JWKSUtils.getKeyWrappersForUse(jwks, JWK.Use.SIG);
    } else {
        try {
            KeyWrapper publicKey = getSavedPublicKey();
            if (publicKey == null) {
                return Collections.emptyMap();
            }
            return Collections.singletonMap(publicKey.getKid(), publicKey);
        } catch (Exception e) {
            logger.warnf(e, "Unable to retrieve publicKey for verify signature of identityProvider '%s' . Error details: %s", config.getAlias(), e.getMessage());
            return Collections.emptyMap();
        }
    }
}