Support ES256 JWK Algo

cmd/keys_create.go

@@ -27,6 +27,6 @@ var keysCreateCmd = &cobra.Command{
 
 func init() {
 	keysCmd.AddCommand(keysCreateCmd)
-	keysCreateCmd.Flags().StringP("alg", "a", "", "REQUIRED name that identifies the algorithm intended for use with the key. Supports: RS256, ES521, HS256")
+	keysCreateCmd.Flags().StringP("alg", "a", "", "REQUIRED name that identifies the algorithm intended for use with the key. Supports: RS256, ES256, ES521, HS256")
 
 }

docs/api.swagger.yaml

@@ -2113,7 +2113,7 @@ definitions:
       alg:
         description: >-
           The algorithm to be used for creating the key. Supports "RS256",
-          "ES521" and "HS256"
+          "ES256", "ES521" and "HS256"
         type: string
         x-go-name: Algorithm
       kid:

jwk/handler.go

@@ -28,6 +28,7 @@ func (h *Handler) GetGenerators() map[string]KeyGenerator {
 	if h.Generators == nil || len(h.Generators) == 0 {
 		h.Generators = map[string]KeyGenerator{
 			"RS256": &RS256Generator{},
+			"ES256": &ECDSA256Generator{},
 			"ES521": &ECDSA521Generator{},
 			"HS256": &HS256Generator{
 				Length: 32,
@@ -52,7 +53,7 @@ func (h *Handler) SetRoutes(r *httprouter.Router) {
 }
 
 type createRequest struct {
-	// The algorithm to be used for creating the key. Supports "RS256", "ES521" and "HS256"
+	// The algorithm to be used for creating the key. Supports "RS256", "ES256", "ES521" and "HS256"
 	// required: true
 	// in: body
 	Algorithm string `json:"alg"`

jwk/handler_test.go

@@ -38,7 +38,7 @@ func init() {
 		},
 	)
 	router := httprouter.New()
-	IDKS, _ = testGenerator.Generate("")
+	IDKS, _ = testGenerators["RS256"].Generate("")
 
 	h := Handler{
 		Manager: &MemoryManager{},

jwk/manager_test.go

@@ -23,7 +23,7 @@ import (
 
 var managers = map[string]Manager{}
 
-var testGenerator = &RS256Generator{}
+var testGenerators = (&Handler{}).GetGenerators()
 
 var ts *httptest.Server
 var httpManager *HTTPManager
@@ -40,13 +40,13 @@ func init() {
 		}, &ladon.DefaultPolicy{
 			ID:        "1",
 			Subjects:  []string{"alice"},
-			Resources: []string{"rn:hydra:keys:<faz|bar|foo|anonymous><.*>"},
+			Resources: []string{"rn:hydra:keys:<RS256|ES256|ES521|HS256><faz|bar|foo|anonymous><.*>"},
 			Actions:   []string{"create", "get", "delete", "update"},
 			Effect:    ladon.AllowAccess,
 		}, &ladon.DefaultPolicy{
 			ID:        "2",
 			Subjects:  []string{"alice", ""},
-			Resources: []string{"rn:hydra:keys:anonymous<.*>"},
+			Resources: []string{"rn:hydra:keys:<RS256|ES256|ES521|HS256>anonymous<.*>"},
 			Actions:   []string{"get"},
 			Effect:    ladon.AllowAccess,
 		},
@@ -99,50 +99,72 @@ func connectToMySQL() {
 }
 
 func TestHTTPManagerPublicKeyGet(t *testing.T) {
-	anonymous := &HTTPManager{Endpoint: httpManager.Endpoint, Client: http.DefaultClient}
-	ks, _ := testGenerator.Generate("")
-	priv := ks.Key("private")
+	for algo, testGenerator := range testGenerators {
+		if algo == "HS256" {
+			// this is a symmetrical algorithm
+			continue
+		}
 
-	name := "http"
-	m := httpManager
+		anonymous := &HTTPManager{Endpoint: httpManager.Endpoint, Client: http.DefaultClient}
+		ks, _ := testGenerator.Generate("")
+		priv := ks.Key("private")
 
-	_, err := m.GetKey("anonymous", "baz")
-	pkg.AssertError(t, true, err, name)
+		name := "http"
+		m := httpManager
 
-	err = m.AddKey("anonymous", First(priv))
-	pkg.AssertError(t, false, err, name)
+		_, err := m.GetKey(algo+"anonymous", "baz")
+		pkg.AssertError(t, true, err, name)
 
-	time.Sleep(time.Millisecond * 100)
+		err = m.AddKey(algo+"anonymous", First(priv))
+		pkg.AssertError(t, false, err, name)
 
-	got, err := anonymous.GetKey("anonymous", "private")
-	pkg.RequireError(t, false, err, name)
-	assert.Equal(t, priv, got.Keys, "%s", name)
+		time.Sleep(time.Millisecond * 100)
+
+		got, err := anonymous.GetKey(algo+"anonymous", "private")
+		pkg.RequireError(t, false, err, name)
+		assert.Equal(t, priv, got.Keys, "%s", name)
+	}
 }
 
 func TestManagerKey(t *testing.T) {
-	ks, _ := testGenerator.Generate("")
-
-	for name, m := range managers {
-		t.Run(fmt.Sprintf("case=%s", name), func(t *testing.T) {
-			TestHelperManagerKey(m, ks)(t)
-		})
+	for algo, testGenerator := range testGenerators {
+		if algo == "HS256" {
+			// this is a symmetrical algorithm
+			continue
+		}
+
+		ks, err := testGenerator.Generate("")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		for name, m := range managers {
+			t.Run(fmt.Sprintf("case=%s/%s", algo, name), func(t *testing.T) {
+				TestHelperManagerKey(m, algo, ks)(t)
+			})
+		}
+
+		priv := ks.Key("private")
+		err = managers["http"].AddKey("nonono", First(priv))
+		assert.NotNil(t, err)
 	}
-
-	priv := ks.Key("private")
-	err := managers["http"].AddKey("nonono", First(priv))
-	assert.NotNil(t, err)
 }
 
 func TestManagerKeySet(t *testing.T) {
-	ks, _ := testGenerator.Generate("")
-	ks.Key("private")
-
-	for name, m := range managers {
-		t.Run(fmt.Sprintf("case=%s", name), func(t *testing.T) {
-			TestHelperManagerKeySet(m, ks)(t)
-		})
+	for algo, testGenerator := range testGenerators {
+		ks, err := testGenerator.Generate("")
+		if err != nil {
+			t.Fatal(err)
+		}
+		ks.Key("private")
+
+		for name, m := range managers {
+			t.Run(fmt.Sprintf("case=%s/%s", algo, name), func(t *testing.T) {
+				TestHelperManagerKeySet(m, algo, ks)(t)
+			})
+		}
+
+		err = managers["http"].AddKeySet("nonono", ks)
+		assert.NotNil(t, err)
 	}
-
-	err := managers["http"].AddKeySet("nonono", ks)
-	assert.NotNil(t, err)
 }

jwk/manager_test_helpers.go

@@ -19,57 +19,57 @@ func RandomBytes(n int) ([]byte, error) {
 	return bytes, nil
 }
 
-func TestHelperManagerKey(m Manager, keys *jose.JSONWebKeySet) func(t *testing.T) {
+func TestHelperManagerKey(m Manager, name string, keys *jose.JSONWebKeySet) func(t *testing.T) {
 	pub := keys.Key("public")
 	priv := keys.Key("private")
 
 	return func(t *testing.T) {
-		_, err := m.GetKey("faz", "baz")
+		_, err := m.GetKey(name+"faz", "baz")
 		assert.NotNil(t, err)
 
-		err = m.AddKey("faz", First(priv))
+		err = m.AddKey(name+"faz", First(priv))
 		assert.Nil(t, err)
 
-		got, err := m.GetKey("faz", "private")
+		got, err := m.GetKey(name+"faz", "private")
 		assert.Nil(t, err)
 		assert.Equal(t, priv, got.Keys)
 
-		err = m.AddKey("faz", First(pub))
+		err = m.AddKey(name+"faz", First(pub))
 		assert.Nil(t, err)
 
-		got, err = m.GetKey("faz", "private")
+		got, err = m.GetKey(name+"faz", "private")
 		assert.Nil(t, err)
 		assert.Equal(t, priv, got.Keys)
 
-		got, err = m.GetKey("faz", "public")
+		got, err = m.GetKey(name+"faz", "public")
 		assert.Nil(t, err)
 		assert.Equal(t, pub, got.Keys)
 
-		err = m.DeleteKey("faz", "public")
+		err = m.DeleteKey(name+"faz", "public")
 		assert.Nil(t, err)
 
-		_, err = m.GetKey("faz", "public")
+		_, err = m.GetKey(name+"faz", "public")
 		assert.NotNil(t, err)
 	}
 }
 
-func TestHelperManagerKeySet(m Manager, keys *jose.JSONWebKeySet) func(t *testing.T) {
+func TestHelperManagerKeySet(m Manager, name string, keys *jose.JSONWebKeySet) func(t *testing.T) {
 	return func(t *testing.T) {
-		_, err := m.GetKeySet("foo")
+		_, err := m.GetKeySet(name + "foo")
 		pkg.AssertError(t, true, err)
 
-		err = m.AddKeySet("bar", keys)
+		err = m.AddKeySet(name+"bar", keys)
 		assert.Nil(t, err)
 
-		got, err := m.GetKeySet("bar")
+		got, err := m.GetKeySet(name + "bar")
 		assert.Nil(t, err)
 		assert.Equal(t, keys.Key("public"), got.Key("public"))
 		assert.Equal(t, keys.Key("private"), got.Key("private"))
 
-		err = m.DeleteKeySet("bar")
+		err = m.DeleteKeySet(name + "bar")
 		assert.Nil(t, err)
 
-		_, err = m.GetKeySet("bar")
+		_, err = m.GetKeySet(name + "bar")
 		assert.NotNil(t, err)
 	}
 }