Examples with JWE org.keycloak.jose.jwe.JWE used on opensource projects

Example 1 with JWE

use of org.keycloak.jose.jwe.JWE in project keycloak by keycloak.

the class TokenUtil method jweKeyEncryptionVerifyAndDecode.

public static byte[] jweKeyEncryptionVerifyAndDecode(Key decryptionKEK, String encodedContent) throws JWEException {
    JWE jwe = new JWE();
    jwe.getKeyStorage().setDecryptionKey(decryptionKEK);
    jwe.verifyAndDecodeJwe(encodedContent);
    return jwe.getContent();
}

Example 2 with JWE

use of org.keycloak.jose.jwe.JWE in project keycloak by keycloak.

the class TokenUtil method jweKeyEncryptionEncode.

private static String jweKeyEncryptionEncode(Key encryptionKEK, byte[] contentBytes, JWEHeader jweHeader, JWEAlgorithmProvider jweAlgorithmProvider, JWEEncryptionProvider jweEncryptionProvider) throws JWEException {
    JWE jwe = new JWE().header(jweHeader).content(contentBytes);
    jwe.getKeyStorage().setEncryptionKey(encryptionKEK);
    String encodedContent = jwe.encodeJwe(jweAlgorithmProvider, jweEncryptionProvider);
    return encodedContent;
}

Example 3 with JWE

use of org.keycloak.jose.jwe.JWE in project keycloak by keycloak.

the class TokenUtil method jweKeyEncryptionVerifyAndDecode.

public static byte[] jweKeyEncryptionVerifyAndDecode(Key decryptionKEK, String encodedContent, JWEAlgorithmProvider algorithmProvider, JWEEncryptionProvider encryptionProvider) throws JWEException {
    JWE jwe = new JWE();
    jwe.getKeyStorage().setDecryptionKey(decryptionKEK);
    jwe.verifyAndDecodeJwe(encodedContent, algorithmProvider, encryptionProvider);
    return jwe.getContent();
}

Example 4 with JWE

use of org.keycloak.jose.jwe.JWE in project keycloak by keycloak.

the class DefaultTokenManager method decodeClientJWT.

@Override
public <T> T decodeClientJWT(String jwt, ClientModel client, BiConsumer<JOSE, ClientModel> jwtValidator, Class<T> clazz) {
    if (jwt == null) {
        return null;
    }
    JOSE joseToken = JOSEParser.parse(jwt);
    jwtValidator.accept(joseToken, client);
    if (joseToken instanceof JWE) {
        try {
            Optional<KeyWrapper> activeKey;
            String kid = joseToken.getHeader().getKeyId();
            Stream<KeyWrapper> keys = session.keys().getKeysStream(session.getContext().getRealm());
            if (kid == null) {
                activeKey = keys.filter(k -> KeyUse.ENC.equals(k.getUse()) && k.getPublicKey() != null).sorted(Comparator.comparingLong(KeyWrapper::getProviderPriority).reversed()).findFirst();
            } else {
                activeKey = keys.filter(k -> KeyUse.ENC.equals(k.getUse()) && k.getKid().equals(kid)).findAny();
            }
            JWE jwe = JWE.class.cast(joseToken);
            Key privateKey = activeKey.map(KeyWrapper::getPrivateKey).orElseThrow(() -> new RuntimeException("Could not find private key for decrypting token"));
            jwe.getKeyStorage().setDecryptionKey(privateKey);
            byte[] content = jwe.verifyAndDecodeJwe().getContent();
            try {
                JOSE jws = JOSEParser.parse(new String(content));
                if (jws instanceof JWSInput) {
                    jwtValidator.accept(jws, client);
                    return verifyJWS(client, clazz, (JWSInput) jws);
                }
            } catch (Exception ignore) {
            // try to decrypt content as is
            }
            return JsonSerialization.readValue(content, clazz);
        } catch (IOException cause) {
            throw new RuntimeException("Failed to deserialize JWT", cause);
        } catch (JWEException cause) {
            throw new RuntimeException("Failed to decrypt JWT", cause);
        }
    }
    return verifyJWS(client, clazz, (JWSInput) joseToken);
}

Example 5 with JWE

use of org.keycloak.jose.jwe.JWE in project keycloak by keycloak.

the class OIDCAdvancedRequestParamsTest method assertRequestObjectEncryption.

private void assertRequestObjectEncryption(JWEHeader jweHeader) throws Exception {
    TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = new TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject();
    requestObject.id(KeycloakModelUtils.generateId());
    requestObject.iat(Long.valueOf(Time.currentTime()));
    requestObject.exp(requestObject.getIat() + Long.valueOf(300));
    requestObject.nbf(requestObject.getIat());
    requestObject.setClientId(oauth.getClientId());
    requestObject.setResponseType("code");
    requestObject.setRedirectUriParam(oauth.getRedirectUri());
    requestObject.setScope("openid");
    byte[] contentBytes = JsonSerialization.writeValueAsBytes(requestObject);
    try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {
        OIDCConfigurationRepresentation representation = SimpleHttp.doGet(getAuthServerRoot().toString() + "realms/" + oauth.getRealm() + "/.well-known/openid-configuration", httpClient).asJson(OIDCConfigurationRepresentation.class);
        String jwksUri = representation.getJwksUri();
        JSONWebKeySet jsonWebKeySet = SimpleHttp.doGet(jwksUri, httpClient).asJson(JSONWebKeySet.class);
        Map<String, PublicKey> keysForUse = JWKSUtils.getKeysForUse(jsonWebKeySet, JWK.Use.ENCRYPTION);
        String keyId = jweHeader.getKeyId();
        if (keyId == null) {
            KeysMetadataRepresentation.KeyMetadataRepresentation encKey = KeyUtils.getActiveEncKey(testRealm().keys().getKeyMetadata(), org.keycloak.crypto.Algorithm.PS256);
            keyId = encKey.getKid();
        }
        PublicKey decryptionKEK = keysForUse.get(keyId);
        JWE jwe = new JWE().header(jweHeader).content(contentBytes);
        jwe.getKeyStorage().setEncryptionKey(decryptionKEK);
        oauth = oauth.request(jwe.encodeJwe());
        oauth.doLogin("test-user@localhost", "password");
        events.expectLogin().assertEvent();
    }
}