Examples with KeyWrapper org.keycloak.crypto.KeyWrapper used on opensource projects

Example 11 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class OIDCIdentityProviderPublicKeyLoader method getSavedPublicKey.

protected KeyWrapper getSavedPublicKey() throws Exception {
    KeyWrapper keyWrapper = null;
    if (config.getPublicKeySignatureVerifier() != null && !config.getPublicKeySignatureVerifier().trim().equals("")) {
        PublicKey publicKey = PemUtils.decodePublicKey(config.getPublicKeySignatureVerifier());
        keyWrapper = new KeyWrapper();
        String presetKeyId = config.getPublicKeySignatureVerifierKeyId();
        String kid = (presetKeyId == null || presetKeyId.trim().isEmpty()) ? KeyUtils.createKeyId(publicKey) : presetKeyId;
        keyWrapper.setKid(kid);
        keyWrapper.setType(KeyType.RSA);
        keyWrapper.setAlgorithm(Algorithm.RS256);
        keyWrapper.setUse(KeyUse.SIG);
        keyWrapper.setPublicKey(publicKey);
    } else {
        logger.warnf("No public key saved on identityProvider %s", config.getAlias());
    }
    return keyWrapper;
}

Example 12 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class OAuthClient method verifyToken.

public <T extends JsonWebToken> T verifyToken(String token, Class<T> clazz) {
    try {
        TokenVerifier<T> verifier = TokenVerifier.create(token, clazz);
        String kid = verifier.getHeader().getKeyId();
        String algorithm = verifier.getHeader().getAlgorithm().name();
        KeyWrapper key = getRealmPublicKey(realm, algorithm, kid);
        AsymmetricSignatureVerifierContext verifierContext;
        switch(algorithm) {
            case Algorithm.ES256:
            case Algorithm.ES384:
            case Algorithm.ES512:
                verifierContext = new ServerECDSASignatureVerifierContext(key);
                break;
            default:
                verifierContext = new AsymmetricSignatureVerifierContext(key);
        }
        verifier.verifierContext(verifierContext);
        verifier.verify();
        return verifier.getToken();
    } catch (VerificationException e) {
        throw new RuntimeException("Failed to decode token", e);
    }
}

Example 13 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class InfinispanPublicKeyStorageProvider method getPublicKey.

private KeyWrapper getPublicKey(String modelKey, String kid, String algorithm, PublicKeyLoader loader) {
    // Check if key is in cache
    PublicKeysEntry entry = keys.get(modelKey);
    if (entry != null) {
        KeyWrapper publicKey = algorithm != null ? getPublicKeyByAlg(entry.getCurrentKeys(), algorithm) : getPublicKey(entry.getCurrentKeys(), kid);
        if (publicKey != null) {
            return publicKey;
        }
    }
    int lastRequestTime = entry == null ? 0 : entry.getLastRequestTime();
    int currentTime = Time.currentTime();
    // Check if we are allowed to send request
    if (currentTime > lastRequestTime + minTimeBetweenRequests) {
        WrapperCallable wrapperCallable = new WrapperCallable(modelKey, loader);
        FutureTask<PublicKeysEntry> task = new FutureTask<>(wrapperCallable);
        FutureTask<PublicKeysEntry> existing = tasksInProgress.putIfAbsent(modelKey, task);
        if (existing == null) {
            task.run();
        } else {
            task = existing;
        }
        try {
            entry = task.get();
            // Computation finished. Let's see if key is available
            KeyWrapper publicKey = algorithm != null ? getPublicKeyByAlg(entry.getCurrentKeys(), algorithm) : getPublicKey(entry.getCurrentKeys(), kid);
            if (publicKey != null) {
                return publicKey;
            }
        } catch (ExecutionException ee) {
            throw new RuntimeException("Error when loading public keys: " + ee.getMessage(), ee);
        } catch (InterruptedException ie) {
            throw new RuntimeException("Error. Interrupted when loading public keys", ie);
        } finally {
            // Our thread inserted the task. Let's clean
            if (existing == null) {
                tasksInProgress.remove(modelKey);
            }
        }
    } else {
        log.warnf("Won't load the keys for model '%s' . Last request time was %d", modelKey, lastRequestTime);
    }
    Set<String> availableKids = entry == null ? Collections.emptySet() : entry.getCurrentKeys().keySet();
    log.warnf("PublicKey wasn't found in the storage. Requested kid: '%s' . Available kids: '%s'", kid, availableKids);
    return null;
}

Example 14 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class AbstractOAuth2IdentityProvider method getSignatureContext.

protected SignatureSignerContext getSignatureContext() {
    if (getConfig().getClientAuthMethod().equals(OIDCLoginProtocol.CLIENT_SECRET_JWT)) {
        try (VaultStringSecret vaultStringSecret = session.vault().getStringSecret(getConfig().getClientSecret())) {
            KeyWrapper key = new KeyWrapper();
            String alg = getConfig().getClientAssertionSigningAlg() != null ? getConfig().getClientAssertionSigningAlg() : Algorithm.HS256;
            key.setAlgorithm(alg);
            byte[] decodedSecret = vaultStringSecret.get().orElse(getConfig().getClientSecret()).getBytes();
            SecretKey secret = new SecretKeySpec(decodedSecret, 0, decodedSecret.length, alg);
            key.setSecretKey(secret);
            return new MacSignatureSignerContext(key);
        }
    }
    String alg = getConfig().getClientAssertionSigningAlg() != null ? getConfig().getClientAssertionSigningAlg() : Algorithm.RS256;
    return new AsymmetricSignatureProvider(session, alg).signer();
}

Example 15 with KeyWrapper

use of org.keycloak.crypto.KeyWrapper in project keycloak by keycloak.

the class HardcodedPublicKeyLoader method getSavedPublicKey.

protected KeyWrapper getSavedPublicKey() {
    KeyWrapper keyWrapper = null;
    if (pem != null && !pem.trim().equals("")) {
        keyWrapper = new KeyWrapper();
        keyWrapper.setKid(kid);
        keyWrapper.setType(KeyType.RSA);
        keyWrapper.setAlgorithm(Algorithm.RS256);
        keyWrapper.setUse(KeyUse.SIG);
        keyWrapper.setPublicKey(PemUtils.decodePublicKey(pem));
    }
    return keyWrapper;
}