From 07654016d3665a57e72a0ed63a54f109f3e3b378 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Oct 27 2016 14:40:49 +0000 Subject: [PATCH 1/2] Re-add request_object_signing_alg client metadata Signed-off-by: Patrick Uiterwijk --- diff --git a/ipsilon/providers/openidc/provider.py b/ipsilon/providers/openidc/provider.py index 4c415d2..7a74257 100644 --- a/ipsilon/providers/openidc/provider.py +++ b/ipsilon/providers/openidc/provider.py @@ -4,7 +4,7 @@ from ipsilon.providers.openidc.api import APIError, APIRequest from ipsilon.util.security import generate_random_secure_string import ipsilon.util.config as pconfig - +from jwcrypto.jws import default_allowed_algs as jws_default_allowed_algs import cherrypy import json import time @@ -228,6 +228,8 @@ class Client(pconfig.ConfigHelper): return '*Autogenerated*' elif option == 'default_max_age': return 0 + elif option == 'request_object_signing_alg': + return 'none' else: return '' @@ -345,6 +347,12 @@ class Client(pconfig.ConfigHelper): ['RS256'], self.get_current_info('id_token_signed_response_alg'), readonly=self.readonly), + pconfig.Pick( + 'Request Object Signing Alg', + 'Algorithm used to sign request objects', + jws_default_allowed_algs + ['none'], + self.get_current_info('request_object_signing_alg'), + readonly=self.readonly), pconfig.String( 'Initiate Login URI', 'URI that third party can use to initiate login at client.', @@ -366,7 +374,6 @@ class Client(pconfig.ConfigHelper): # userinfo_signed_response_alg # userinfo_encrypted_response_alg # userinfo_encrypted_response_enc - # request_object_signing_alg (defualt none) # request_object_encryption_alg # request_object_encryption_enc # token_endpoint_auth_signing_alg From dca4bbaccebc95c80f55027b3f927edf3622a9a1 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Oct 27 2016 14:41:50 +0000 Subject: [PATCH 2/2] Fix indentation on OIDC signed request objects code Signed-off-by: Patrick Uiterwijk --- diff --git a/ipsilon/providers/openidc/auth.py b/ipsilon/providers/openidc/auth.py index 28e1dde..a52a730 100644 --- a/ipsilon/providers/openidc/auth.py +++ b/ipsilon/providers/openidc/auth.py @@ -237,21 +237,21 @@ class Authorization(AuthenticateRequest): raise Exception('Invalid algorithm used: %s' % decoded.token.jose_header['alg']) - if client['request_object_signing_alg'] == 'none': - jwt_request = json.loads( - decoded.token.objects['payload']) + if client['request_object_signing_alg'] == 'none': + jwt_request = json.loads( + decoded.token.objects['payload']) + else: + keyset = None + if client['jwks']: + keys = json.loads(client['jkws']) else: - keyset = None - if client['jwks']: - keys = json.loads(client['jkws']) - else: - keys = requests.get(client['jwks_uri']).json() - keyset = JWKSet() - for key in keys['keys']: - keyset.add(JWK(**key)) - key = keyset.get_key(decoded.token.jose_header['kid']) - decoded = JWT(jwt=jwt_object, key=key) - jwt_request = json.loads(decoded.claims) + keys = requests.get(client['jwks_uri']).json() + keyset = JWKSet() + for key in keys['keys']: + keyset.add(JWK(**key)) + key = keyset.get_key(decoded.token.jose_header['kid']) + decoded = JWT(jwt=jwt_object, key=key) + jwt_request = json.loads(decoded.claims) except Exception as ex: # pylint: disable=broad-except self.debug('Unable to parse request: %s' % ex)