Examples with JSONWebKeySet org.keycloak.jose.jwk.JSONWebKeySet used on opensource projects

Example 6 with JSONWebKeySet

use of org.keycloak.jose.jwk.JSONWebKeySet in project keycloak by keycloak.

the class OIDCWellKnownProviderTest method certs.

@Test
public void certs() throws IOException {
    TokenSignatureUtil.registerKeyProvider(Algorithm.ES256, adminClient, testContext);
    OIDCConfigurationRepresentation representation = SimpleHttp.doGet(getAuthServerRoot().toString() + "realms/test/.well-known/openid-configuration", client).asJson(OIDCConfigurationRepresentation.class);
    String jwksUri = representation.getJwksUri();
    JSONWebKeySet jsonWebKeySet = SimpleHttp.doGet(jwksUri, client).asJson(JSONWebKeySet.class);
    assertEquals(2, jsonWebKeySet.getKeys().length);
}

Example 7 with JSONWebKeySet

use of org.keycloak.jose.jwk.JSONWebKeySet in project keycloak by keycloak.

the class OIDCAdvancedRequestParamsTest method assertRequestObjectEncryption.

private void assertRequestObjectEncryption(JWEHeader jweHeader) throws Exception {
    TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = new TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject();
    requestObject.id(KeycloakModelUtils.generateId());
    requestObject.iat(Long.valueOf(Time.currentTime()));
    requestObject.exp(requestObject.getIat() + Long.valueOf(300));
    requestObject.nbf(requestObject.getIat());
    requestObject.setClientId(oauth.getClientId());
    requestObject.setResponseType("code");
    requestObject.setRedirectUriParam(oauth.getRedirectUri());
    requestObject.setScope("openid");
    byte[] contentBytes = JsonSerialization.writeValueAsBytes(requestObject);
    try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {
        OIDCConfigurationRepresentation representation = SimpleHttp.doGet(getAuthServerRoot().toString() + "realms/" + oauth.getRealm() + "/.well-known/openid-configuration", httpClient).asJson(OIDCConfigurationRepresentation.class);
        String jwksUri = representation.getJwksUri();
        JSONWebKeySet jsonWebKeySet = SimpleHttp.doGet(jwksUri, httpClient).asJson(JSONWebKeySet.class);
        Map<String, PublicKey> keysForUse = JWKSUtils.getKeysForUse(jsonWebKeySet, JWK.Use.ENCRYPTION);
        String keyId = jweHeader.getKeyId();
        if (keyId == null) {
            KeysMetadataRepresentation.KeyMetadataRepresentation encKey = KeyUtils.getActiveEncKey(testRealm().keys().getKeyMetadata(), org.keycloak.crypto.Algorithm.PS256);
            keyId = encKey.getKid();
        }
        PublicKey decryptionKEK = keysForUse.get(keyId);
        JWE jwe = new JWE().header(jweHeader).content(contentBytes);
        jwe.getKeyStorage().setEncryptionKey(decryptionKEK);
        oauth = oauth.request(jwe.encodeJwe());
        oauth.doLogin("test-user@localhost", "password");
        events.expectLogin().assertEvent();
    }
}

Example 8 with JSONWebKeySet

use of org.keycloak.jose.jwk.JSONWebKeySet in project keycloak by keycloak.

the class OIDCLoginProtocolService method certs.

@GET
@Path("certs")
@Produces(MediaType.APPLICATION_JSON)
@NoCache
public Response certs() {
    checkSsl();
    JWK[] jwks = session.keys().getKeysStream(realm).filter(k -> k.getStatus().isEnabled() && k.getPublicKey() != null).map(k -> {
        JWKBuilder b = JWKBuilder.create().kid(k.getKid()).algorithm(k.getAlgorithmOrDefault());
        List<X509Certificate> certificates = Optional.ofNullable(k.getCertificateChain()).filter(certs -> !certs.isEmpty()).orElseGet(() -> Collections.singletonList(k.getCertificate()));
        if (k.getType().equals(KeyType.RSA)) {
            return b.rsa(k.getPublicKey(), certificates, k.getUse());
        } else if (k.getType().equals(KeyType.EC)) {
            return b.ec(k.getPublicKey());
        }
        return null;
    }).filter(Objects::nonNull).toArray(JWK[]::new);
    JSONWebKeySet keySet = new JSONWebKeySet();
    keySet.setKeys(jwks);
    Response.ResponseBuilder responseBuilder = Response.ok(keySet).cacheControl(CacheControlUtil.getDefaultCacheControl());
    return Cors.add(request, responseBuilder).allowedOrigins("*").auth().build();
}

Example 9 with JSONWebKeySet

use of org.keycloak.jose.jwk.JSONWebKeySet in project keycloak by keycloak.

the class ClientPublicKeyLoader method loadKeys.

@Override
public Map<String, KeyWrapper> loadKeys() throws Exception {
    OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientModel(client);
    if (config.isUseJwksUrl()) {
        String jwksUrl = config.getJwksUrl();
        jwksUrl = ResolveRelative.resolveRelativeUri(session, client.getRootUrl(), jwksUrl);
        JSONWebKeySet jwks = JWKSHttpUtils.sendJwksRequest(session, jwksUrl);
        return JWKSUtils.getKeyWrappersForUse(jwks, keyUse);
    } else if (config.isUseJwksString()) {
        JSONWebKeySet jwks = JsonSerialization.readValue(config.getJwksString(), JSONWebKeySet.class);
        return JWKSUtils.getKeyWrappersForUse(jwks, keyUse);
    } else if (keyUse == JWK.Use.SIG) {
        try {
            CertificateRepresentation certInfo = CertificateInfoHelper.getCertificateFromClient(client, JWTClientAuthenticator.ATTR_PREFIX);
            KeyWrapper publicKey = getSignatureValidationKey(certInfo);
            return Collections.singletonMap(publicKey.getKid(), publicKey);
        } catch (ModelException me) {
            logger.warnf(me, "Unable to retrieve publicKey for verify signature of client '%s' . Error details: %s", client.getClientId(), me.getMessage());
            return Collections.emptyMap();
        }
    } else {
        logger.warnf("Unable to retrieve publicKey of client '%s' for the specified purpose other than verifying signature", client.getClientId());
        return Collections.emptyMap();
    }
}

Example 10 with JSONWebKeySet

use of org.keycloak.jose.jwk.JSONWebKeySet in project keycloak by keycloak.

the class OIDCIdentityProviderPublicKeyLoader method loadKeys.

@Override
public Map<String, KeyWrapper> loadKeys() throws Exception {
    if (config.isUseJwksUrl()) {
        String jwksUrl = config.getJwksUrl();
        JSONWebKeySet jwks = JWKSHttpUtils.sendJwksRequest(session, jwksUrl);
        return JWKSUtils.getKeyWrappersForUse(jwks, JWK.Use.SIG);
    } else {
        try {
            KeyWrapper publicKey = getSavedPublicKey();
            if (publicKey == null) {
                return Collections.emptyMap();
            }
            return Collections.singletonMap(publicKey.getKid(), publicKey);
        } catch (Exception e) {
            logger.warnf(e, "Unable to retrieve publicKey for verify signature of identityProvider '%s' . Error details: %s", config.getAlias(), e.getMessage());
            return Collections.emptyMap();
        }
    }
}