Skip to content

Commit 44303d2

Browse files
jgrandjajgrandja
committed
Polish gh-17080 
1 parent 462e38c commit 44303d2

File tree

3 files changed

+14
-31
lines changed

3 files changed

+14
-31
lines changed

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationConfigurerTests.java

Lines changed: 12 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818

1919
import java.nio.charset.StandardCharsets;
2020
import java.security.MessageDigest;
21-
import java.security.PublicKey;
2221
import java.security.interfaces.ECPrivateKey;
2322
import java.security.interfaces.ECPublicKey;
2423
import java.security.interfaces.RSAPrivateKey;
@@ -33,6 +32,7 @@
3332
import java.util.UUID;
3433

3534
import com.nimbusds.jose.jwk.ECKey;
35+
import com.nimbusds.jose.jwk.JWK;
3636
import com.nimbusds.jose.jwk.JWKSet;
3737
import com.nimbusds.jose.jwk.RSAKey;
3838
import com.nimbusds.jose.jwk.source.JWKSource;
@@ -89,6 +89,8 @@ public class DPoPAuthenticationConfigurerTests {
8989

9090
private static final ECPrivateKey CLIENT_EC_PRIVATE_KEY = (ECPrivateKey) TestKeys.DEFAULT_EC_KEY_PAIR.getPrivate();
9191

92+
private static final ECKey CLIENT_EC_KEY = TestJwks.jwk(CLIENT_EC_PUBLIC_KEY, CLIENT_EC_PRIVATE_KEY).build();
93+
9294
private static NimbusJwtEncoder providerJwtEncoder;
9395

9496
private static NimbusJwtEncoder clientJwtEncoder;
@@ -104,17 +106,16 @@ public static void init() {
104106
JWKSource<SecurityContext> providerJwkSource = (jwkSelector, securityContext) -> jwkSelector
105107
.select(new JWKSet(providerRsaKey));
106108
providerJwtEncoder = new NimbusJwtEncoder(providerJwkSource);
107-
ECKey clientEcKey = TestJwks.jwk(CLIENT_EC_PUBLIC_KEY, CLIENT_EC_PRIVATE_KEY).build();
108109
JWKSource<SecurityContext> clientJwkSource = (jwkSelector, securityContext) -> jwkSelector
109-
.select(new JWKSet(clientEcKey));
110+
.select(new JWKSet(CLIENT_EC_KEY));
110111
clientJwtEncoder = new NimbusJwtEncoder(clientJwkSource);
111112
}
112113

113114
@Test
114115
public void requestWhenDPoPAndBearerAuthenticationThenUnauthorized() throws Exception {
115116
this.spring.register(SecurityConfig.class, ResourceEndpoints.class).autowire();
116117
Set<String> scope = Collections.singleton("resource1.read");
117-
String accessToken = generateAccessToken(scope, CLIENT_EC_PUBLIC_KEY);
118+
String accessToken = generateAccessToken(scope, CLIENT_EC_KEY);
118119
String dPoPProof = generateDPoPProof(HttpMethod.GET.name(), "http://localhost/resource1", accessToken);
119120
// @formatter:off
120121
this.mvc.perform(get("/resource1")
@@ -131,7 +132,7 @@ public void requestWhenDPoPAndBearerAuthenticationThenUnauthorized() throws Exce
131132
public void requestWhenDPoPAccessTokenMalformedThenUnauthorized() throws Exception {
132133
this.spring.register(SecurityConfig.class, ResourceEndpoints.class).autowire();
133134
Set<String> scope = Collections.singleton("resource1.read");
134-
String accessToken = generateAccessToken(scope, CLIENT_EC_PUBLIC_KEY);
135+
String accessToken = generateAccessToken(scope, CLIENT_EC_KEY);
135136
String dPoPProof = generateDPoPProof(HttpMethod.GET.name(), "http://localhost/resource1", accessToken);
136137
// @formatter:off
137138
this.mvc.perform(get("/resource1")
@@ -147,7 +148,7 @@ public void requestWhenDPoPAccessTokenMalformedThenUnauthorized() throws Excepti
147148
public void requestWhenMultipleDPoPProofsThenUnauthorized() throws Exception {
148149
this.spring.register(SecurityConfig.class, ResourceEndpoints.class).autowire();
149150
Set<String> scope = Collections.singleton("resource1.read");
150-
String accessToken = generateAccessToken(scope, CLIENT_EC_PUBLIC_KEY);
151+
String accessToken = generateAccessToken(scope, CLIENT_EC_KEY);
151152
String dPoPProof = generateDPoPProof(HttpMethod.GET.name(), "http://localhost/resource1", accessToken);
152153
// @formatter:off
153154
this.mvc.perform(get("/resource1")
@@ -164,7 +165,7 @@ public void requestWhenMultipleDPoPProofsThenUnauthorized() throws Exception {
164165
public void requestWhenDPoPAuthenticationValidThenAccessed() throws Exception {
165166
this.spring.register(SecurityConfig.class, ResourceEndpoints.class).autowire();
166167
Set<String> scope = Collections.singleton("resource1.read");
167-
String accessToken = generateAccessToken(scope, CLIENT_EC_PUBLIC_KEY);
168+
String accessToken = generateAccessToken(scope, CLIENT_EC_KEY);
168169
String dPoPProof = generateDPoPProof(HttpMethod.GET.name(), "http://localhost/resource1", accessToken);
169170
// @formatter:off
170171
this.mvc.perform(get("/resource1")
@@ -175,11 +176,11 @@ public void requestWhenDPoPAuthenticationValidThenAccessed() throws Exception {
175176
// @formatter:on
176177
}
177178

178-
private static String generateAccessToken(Set<String> scope, PublicKey clientPublicKey) {
179+
private static String generateAccessToken(Set<String> scope, JWK jwk) {
179180
Map<String, Object> jktClaim = null;
180-
if (clientPublicKey != null) {
181+
if (jwk != null) {
181182
try {
182-
String sha256Thumbprint = computeSHA256(clientPublicKey);
183+
String sha256Thumbprint = jwk.toPublicJWK().computeThumbprint().toString();
183184
jktClaim = new HashMap<>();
184185
jktClaim.put("jkt", sha256Thumbprint);
185186
}
@@ -207,10 +208,7 @@ private static String generateAccessToken(Set<String> scope, PublicKey clientPub
207208

208209
private static String generateDPoPProof(String method, String resourceUri, String accessToken) throws Exception {
209210
// @formatter:off
210-
Map<String, Object> publicJwk = TestJwks.jwk(CLIENT_EC_PUBLIC_KEY, CLIENT_EC_PRIVATE_KEY)
211-
.build()
212-
.toPublicJWK()
213-
.toJSONObject();
211+
Map<String, Object> publicJwk = CLIENT_EC_KEY.toPublicJWK().toJSONObject();
214212
JwsHeader jwsHeader = JwsHeader.with(SignatureAlgorithm.ES256)
215213
.type("dpop+jwt")
216214
.jwk(publicJwk)
@@ -233,12 +231,6 @@ private static String computeSHA256(String value) throws Exception {
233231
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
234232
}
235233

236-
private static String computeSHA256(PublicKey publicKey) throws Exception {
237-
MessageDigest md = MessageDigest.getInstance("SHA-256");
238-
byte[] digest = md.digest(publicKey.getEncoded());
239-
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
240-
}
241-
242234
@Configuration
243235
@EnableWebSecurity
244236
@EnableWebMvc

‎oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/DPoPAuthenticationProvider.java

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,11 @@
1818

1919
import java.nio.charset.StandardCharsets;
2020
import java.security.MessageDigest;
21-
import java.security.PublicKey;
2221
import java.time.Instant;
2322
import java.util.Base64;
2423
import java.util.Map;
2524
import java.util.function.Function;
2625

27-
import com.nimbusds.jose.jwk.AsymmetricJWK;
2826
import com.nimbusds.jose.jwk.JWK;
2927

3028
import org.springframework.security.authentication.AuthenticationManager;
@@ -243,12 +241,6 @@ private static OAuth2Error createOAuth2Error(String reason) {
243241
return new OAuth2Error(OAuth2ErrorCodes.INVALID_DPOP_PROOF, reason, null);
244242
}
245243

246-
private static String computeSHA256(PublicKey publicKey) throws Exception {
247-
MessageDigest md = MessageDigest.getInstance("SHA-256");
248-
byte[] digest = md.digest(publicKey.getEncoded());
249-
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
250-
}
251-
252244
}
253245

254246
private static final class OAuth2AccessTokenClaims implements OAuth2Token, ClaimAccessor {

‎oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/authentication/DPoPAuthenticationProviderTests.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818

1919
import java.nio.charset.StandardCharsets;
2020
import java.security.MessageDigest;
21-
import java.security.PublicKey;
2221
import java.time.Instant;
2322
import java.time.temporal.ChronoUnit;
2423
import java.util.Base64;
@@ -37,7 +36,6 @@
3736
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
3837
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
3938
import org.springframework.security.oauth2.jose.TestJwks;
40-
import org.springframework.security.oauth2.jose.TestKeys;
4139
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
4240
import org.springframework.security.oauth2.jwt.JwsHeader;
4341
import org.springframework.security.oauth2.jwt.Jwt;
@@ -293,7 +291,7 @@ private Jwt generateAccessToken(JWK clientJwk) {
293291
Map<String, Object> jktClaim = null;
294292
if (clientJwk != null) {
295293
try {
296-
String sha256Thumbprint = clientJwk.computeThumbprint().toString();
294+
String sha256Thumbprint = clientJwk.toPublicJWK().computeThumbprint().toString();
297295
jktClaim = new HashMap<>();
298296
jktClaim.put("jkt", sha256Thumbprint);
299297
}
@@ -322,4 +320,5 @@ private static String computeSHA256(String value) throws Exception {
322320
byte[] digest = md.digest(value.getBytes(StandardCharsets.UTF_8));
323321
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
324322
}
323+
325324
}

0 commit comments

Comments
 (0)