Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(security): require signed/encrypted jwt tokens #6565

Merged
merged 11 commits into from
Dec 26, 2022
Merged

fix(security): require signed/encrypted jwt tokens #6565

Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
fd69571
fix(security): require unsigned/encrypted jwt tokens
david-leifker Nov 29, 2022
dd520c8
Merge branch 'master' into david-leifker/require-jwt-signature
david-leifker Nov 29, 2022
d8e86d6
Merge branch 'master' into david-leifker/require-jwt-signature
pedro93 Nov 29, 2022
2e42ce7
Merge branch 'master' into david-leifker/require-jwt-signature
david-leifker Nov 30, 2022
27207a3
Merge branch 'master' into david-leifker/require-jwt-signature
david-leifker Dec 9, 2022
ad976b9
Add import
david-leifker Dec 9, 2022
95df0e0
Merge branch 'master' into david-leifker/require-jwt-signature
david-leifker Dec 15, 2022
79fdc68
Merge branch 'master' into david-leifker/require-jwt-signature
david-leifker Dec 20, 2022
57e3073
Merge branch 'master' into david-leifker/require-jwt-signature
pedro93 Dec 24, 2022
203c23f
Merge branch 'master' into david-leifker/require-jwt-signature
pedro93 Dec 26, 2022
428d7ca
Merge branch 'master' into david-leifker/require-jwt-signature
pedro93 Dec 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 38 additions & 1 deletion datahub-frontend/app/auth/sso/oidc/OidcAuthorizationGenerator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,19 @@
package auth.sso.oidc;

import java.text.ParseException;
import java.util.Map.Entry;
import java.util.Optional;

import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.Header;
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.util.Base64URL;
import com.nimbusds.jose.util.JSONObjectUtils;
import com.nimbusds.jwt.EncryptedJWT;
import com.nimbusds.jwt.JWTParser;
import com.nimbusds.jwt.SignedJWT;
import net.minidev.json.JSONObject;
import org.pac4j.core.authorization.generator.AuthorizationGenerator;
import org.pac4j.core.context.WebContext;
import org.pac4j.core.profile.AttributeLocation;
Expand All @@ -14,7 +25,6 @@
import org.slf4j.LoggerFactory;

import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTParser;

public class OidcAuthorizationGenerator implements AuthorizationGenerator {

Expand Down Expand Up @@ -53,5 +63,32 @@ public Optional<UserProfile> generate(WebContext context, UserProfile profile) {

return Optional.ofNullable(profile);
}

private static JWT parse(final String s) throws ParseException {
final int firstDotPos = s.indexOf(".");

if (firstDotPos == -1) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to write this logic ourselves? Cannot we ask the JWT (or JWS) Parser to parse, and then verify that the signing key exists and is in a supported set?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It could throw an exception based on the class returned, however it is likely to result in a false positive when run against automated scans.

throw new ParseException("Invalid JWT serialization: Missing dot delimiter(s)", 0);
}

Base64URL header = new Base64URL(s.substring(0, firstDotPos));
JSONObject jsonObject;

try {
jsonObject = JSONObjectUtils.parse(header.decodeToString());
} catch (ParseException e) {
throw new ParseException("Invalid unsecured/JWS/JWE header: " + e.getMessage(), 0);
}

Algorithm alg = Header.parseAlgorithm(jsonObject);

if (alg instanceof JWSAlgorithm) {
return SignedJWT.parse(s);
} else if (alg instanceof JWEAlgorithm) {
return EncryptedJWT.parse(s);
} else {
throw new AssertionError("Unexpected algorithm type: " + alg);
}
}

}