[58320] Exposing sign in service public key for access token decoding

[bosawt]

Summary

• This PR adds a route: /sign_in/openid_connect/certs , that allows for any Sign in Service client to retrieve the public key associated with encoded access_token jets. This can be useful for clients to decode the access tokens and confirm this access token came from the sign in service

Related issue(s)

• Expose Sign in Service token signing public key via route va.gov-team#58320

Testing done

• Made a request to: localhost:3000/sign_in/openid_connect/certs, confirmed response:
  {"keys":[{"kty":"RSA","n":"q-pGrTVuIUeEXkcJAftVRfw3SSCZOXisy6SQ6ArhxirP5vvP2e0kN2XnSmBsIln05KnjLaOc5Ai-tDZk-euknDiBO_1qqUHg2LyCefyZYKtBdTfaGS-pVVfGfUo56WnAiRU5B43kvHCT8LDqy9hWI5Rf34p0KinLoOhtcwJEmdhnqw-DYxHSKAd55pl-pTPsvj2fj2yRJ_JRS6JrFTNYW3BSHQPaPYLtfrBEYXj6W-Xca3l0M9TNkqPycP5XNmk--6d1aaGvVXzLSeCoi0XvaQ6kQxStzPFpRiBBvM7kqRpPwzZH1Cck3JUdeKAbTfemBKOKW3Xi0gL58WtHLHmsIQ","e":"AQAB","alg":"RS256","use":"sig","kid":"3466532fee9067b03724e8afe31d567cadc0bd8a54b0635c8f93f4651b0c432e"}]}

What areas of the site does it impact?

Sign in Service Authentication

Acceptance criteria

• Hit the following endpoint: localhost:3000/sign_in/openid_connect/certs
• Decode the resulting JWK and confirm this is the intended certificate (intended certificate is the public_key corresponding to Settings.sign_in.jwt_encode_key
• Confirm the resulting JWK does NOT expose the Sign in Service encoding private key

[joeniquette]

@bosawt Im not able to extract the public cert from the URL. I tried to use the jwt.io site and decode the value at the n atttribute and got an error saying the signature wasn't valid. I then went the rails route and tried:

uri = URI.parse('http://localhost:3000/sign_in/openid_connect/c
erts')
response = JSON.parse(Net::HTTP.get_response(uri).body)
jwk = response['keys'].first
public_key = JWT::JWK::RSA.import(jwk).public_key

the result of printing public_key returned basically a blank key, I think. I at least have never seen it this way. Perhaps this is expected?
#<OpenSSL::PKey::RSA:0x0000000147cb0f28 oid=rsaEncryption>

[bramleyjl]

the result of printing public_key returned basically a blank key, I think. I at least have never seen it this way. Perhaps this is expected? #<OpenSSL::PKey::RSA:0x0000000147cb0f28 oid=rsaEncryption>

@joeniquette I followed your steps and tried printing it out to a string, looks fine to me?

3.2.0 :014 > public_key.to_s
 => "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq+pGrTVuIUeEXkcJAftV\nRfw3SSCZOXisy6SQ6ArhxirP5vvP2e0kN2XnSmBsIln05KnjLaOc5Ai+tDZk+euk\nnDiBO/1qqUHg2LyCefyZYKtBdTfaGS+pVVfGfUo56WnAiRU5B43kvHCT8LDqy9hW\nI5Rf34p0KinLoOhtcwJEmdhnqw+DYxHSKAd55pl+pTPsvj2fj2yRJ/JRS6JrFTNY\nW3BSHQPaPYLtfrBEYXj6W+Xca3l0M9TNkqPycP5XNmk++6d1aaGvVXzLSeCoi0Xv\naQ6kQxStzPFpRiBBvM7kqRpPwzZH1Cck3JUdeKAbTfemBKOKW3Xi0gL58WtHLHms\nIQIDAQAB\n-----END PUBLIC KEY-----\n"  

[bramleyjl]

Tested and got a public key, LGTM!

[bosawt]

@bosawt Im not able to extract the public cert from the URL. I tried to use the jwt.io site and decode the value at the n atttribute and got an error saying the signature wasn't valid. I then went the rails route and tried:

uri = URI.parse('http://localhost:3000/sign_in/openid_connect/c
erts')
response = JSON.parse(Net::HTTP.get_response(uri).body)
jwk = response['keys'].first
public_key = JWT::JWK::RSA.import(jwk).public_key

the result of printing public_key returned basically a blank key, I think. I at least have never seen it this way. Perhaps this is expected? #<OpenSSL::PKey::RSA:0x0000000147cb0f28 oid=rsaEncryption>

@joeniquette Were you able to figure this out for you? I admit I'm not in love with the JWK thing as it's a pain to get the public key out of it, but 🤷 I guess it's part of the OIDC spec

[ryan-mcneil]

LGTM

[joeniquette]

I just tried it again and was able to get it to work. Thank you John, I was missing the `.to_s` 🤦. I wish the jwt.io site compare worked here, but I dont have time to figure out why it doesnt. You dont need my approval to merge, but yes I confirmed this does work and returns only the public key.

…

On Fri, May 26, 2023 at 1:21 PM Ryan McNeil ***@***.***> wrote: ***@***.**** approved this pull request. LGTM — Reply to this email directly, view it on GitHub <#12814 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AQ745HTVFV6GFKQSAI7MUXDXIDQ75ANCNFSM6AAAAAAYPQEBKE> . You are receiving this because you were mentioned.Message ID: <department-of-veterans-affairs/vets-api/pull/12814/review/1446657637@ github.com>

-- Respectfully, *Joe Niquette*