Skip to content

Commit 27cab9b

Browse files
cicnavicicnavi
committed
WIP
1 parent 2479e92 commit 27cab9b

19 files changed

Lines changed: 419 additions & 1066 deletions

‎config/module_oidc.php.dist‎

Lines changed: 317 additions & 253 deletions
Large diffs are not rendered by default.

‎docker/ssp/module_oidc.php‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,6 @@
2121
ModuleConfig::OPTION_TOKEN_REFRESH_TOKEN_TTL => 'P1M',
2222
ModuleConfig::OPTION_TOKEN_ACCESS_TOKEN_TTL => 'PT1H',
2323

24-
ModuleConfig::OPTION_TOKEN_SIGNER => \Lcobucci\JWT\Signer\Rsa\Sha256::class,
25-
2624
ModuleConfig::OPTION_PROTOCOL_SIGNATURE_KEY_PAIRS => [
2725
[
2826
ModuleConfig::KEY_ALGORITHM => \SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum::RS256,

‎docs/6-oidc-upgrade.md‎

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,28 +11,54 @@ New features:
1111
Federation signing algorithms and key pairs. This was introduced in order to
1212
support signature algorithm negotiation with the clients.
1313
- Clients can now be configured with new properties:
14-
- ID Token Signing Algorithm (id_token_signed_response_alg)
14+
- ID Token Signing Algorithm (`id_token_signed_response_alg`)
1515
- Initial support for OpenID for Verifiable Credential Issuance
1616
(OpenID4VCI). Note that the implementation is experimental. You should not use
1717
it in production.
1818

1919
New configuration options:
2020

21-
- ModuleConfig::OPTION_PROTOCOL_SIGNATURE_KEY_PAIRS - (required) enables defining
21+
- `ModuleConfig::OPTION_PROTOCOL_SIGNATURE_KEY_PAIRS` - (required) enables defining
2222
multiple protocol (Connect) related signing algorithms and key pairs.
23-
- ModuleConfig::OPTION_FEDERATION_SIGNATURE_KEY_PAIRS - (required if federation
23+
- `ModuleConfig::OPTION_FEDERATION_SIGNATURE_KEY_PAIRS` - (required if federation
2424
capabilities are enabled) enables defining multiple key pairs for
2525
Federation purposes like signing Entity Statements, publishing new key for
2626
key roll-ower scenarios, etc.
27-
- ModuleConfig::OPTION_TIMESTAMP_VALIDATION_LEEWAY - optional, used for setting
27+
- `ModuleConfig::OPTION_TIMESTAMP_VALIDATION_LEEWAY` - optional, used for setting
2828
allowed time tolerance for timestamp validation in artifacts like JWSs.
2929
multiple Federation related signing algorithms and key pairs.
3030
- Several new options regarding experimental support for OpenID4VCI.
3131

3232
Major impact changes:
3333

34-
- The following configuration options are removed:
35-
-
34+
- The following configuration options related to protocol (Connect)
35+
signature algorithm and key pair are removed:
36+
- `ModuleConfig::OPTION_PKI_PRIVATE_KEY_PASSPHRASE`
37+
- `ModuleConfig::OPTION_PKI_PRIVATE_KEY_FILENAME`
38+
- `ModuleConfig::OPTION_PKI_CERTIFICATE_FILENAME`
39+
- `ModuleConfig::OPTION_TOKEN_SIGNER`
40+
- `ModuleConfig::OPTION_PKI_NEW_PRIVATE_KEY_PASSPHRASE`
41+
- `ModuleConfig::OPTION_PKI_NEW_PRIVATE_KEY_FILENAME`
42+
- `ModuleConfig::OPTION_PKI_NEW_CERTIFICATE_FILENAME`
43+
44+
Instead of those options, now you must use option
45+
`ModuleConfig::OPTION_PROTOCOL_SIGNATURE_KEY_PAIRS` in which you can define
46+
all supported signature keys for protocol (Connect) purposes.
47+
- The following configuration options related to Federation signature algorithm
48+
and key pair are removed:
49+
- `ModuleConfig::OPTION_PKI_FEDERATION_PRIVATE_KEY_PASSPHRASE`
50+
- `ModuleConfig::OPTION_PKI_FEDERATION_PRIVATE_KEY_FILENAME`
51+
- `ModuleConfig::OPTION_PKI_FEDERATION_CERTIFICATE_FILENAME`
52+
- `ModuleConfig::OPTION_FEDERATION_TOKEN_SIGNER`
53+
- `ModuleConfig::OPTION_PKI_FEDERATION_NEW_PRIVATE_KEY_PASSPHRASE`
54+
- `ModuleConfig::OPTION_PKI_FEDERATION_NEW_PRIVATE_KEY_FILENAME`
55+
- `ModuleConfig::OPTION_PKI_FEDERATION_NEW_CERTIFICATE_FILENAME`
56+
57+
Instead of those options, now you must use option
58+
`ModuleConfig::OPTION_FEDERATION_SIGNATURE_KEY_PAIRS` in which you can define
59+
all the supported signature keys for Federation purposes.
60+
- Removed config option `ModuleConfig::OPTION_HOMEPAGE_URI`. Use
61+
`ModuleConfig::OPTION_ORGANIZATION_URI` instead.
3662
- In v6 of the module, when defining custom scopes, there was a possibility to
3763
use standard claims with the 'are_multiple_claim_values_allowed' option.
3864
This would allow multiple values (array of values) for standard claims which

‎src/Controllers/Federation/EntityStatementController.php‎

Lines changed: 57 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -8,22 +8,17 @@
88
use SimpleSAML\Module\oidc\ModuleConfig;
99
use SimpleSAML\Module\oidc\Repositories\ClientRepository;
1010
use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
11-
use SimpleSAML\Module\oidc\Services\JsonWebTokenBuilderService;
1211
use SimpleSAML\Module\oidc\Services\LoggerService;
1312
use SimpleSAML\Module\oidc\Services\OpMetadataService;
1413
use SimpleSAML\Module\oidc\Utils\FederationCache;
15-
use SimpleSAML\Module\oidc\Utils\FingerprintGenerator;
1614
use SimpleSAML\Module\oidc\Utils\Routes;
17-
use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum;
1815
use SimpleSAML\OpenID\Codebooks\ClaimsEnum;
1916
use SimpleSAML\OpenID\Codebooks\ClientRegistrationTypesEnum;
2017
use SimpleSAML\OpenID\Codebooks\ContentTypesEnum;
2118
use SimpleSAML\OpenID\Codebooks\EntityTypesEnum;
2219
use SimpleSAML\OpenID\Codebooks\ErrorsEnum;
2320
use SimpleSAML\OpenID\Codebooks\HttpHeadersEnum;
24-
use SimpleSAML\OpenID\Codebooks\JwtTypesEnum;
2521
use SimpleSAML\OpenID\Federation;
26-
use SimpleSAML\OpenID\Jwk;
2722
use SimpleSAML\OpenID\Jwks;
2823
use Symfony\Component\HttpFoundation\Request;
2924
use Symfony\Component\HttpFoundation\Response;
@@ -38,14 +33,12 @@ class EntityStatementController
3833
*/
3934
public function __construct(
4035
protected readonly ModuleConfig $moduleConfig,
41-
protected readonly JsonWebTokenBuilderService $jsonWebTokenBuilderService,
4236
protected readonly Jwks $jwks,
4337
protected readonly OpMetadataService $opMetadataService,
4438
protected readonly ClientRepository $clientRepository,
4539
protected readonly Helpers $helpers,
4640
protected readonly Routes $routes,
4741
protected readonly Federation $federation,
48-
protected readonly Jwk $jwk,
4942
protected readonly LoggerService $loggerService,
5043
protected readonly ?FederationCache $federationCache,
5144
) {
@@ -76,20 +69,14 @@ public function configuration(): Response
7669

7770
$currentTimestamp = $this->helpers->dateTime()->getUtc()->getTimestamp();
7871

79-
$header = [
80-
ClaimsEnum::Kid->value => FingerprintGenerator::forFile(
81-
$this->moduleConfig->getFederationCertPath(),
82-
),
83-
];
84-
8572
$jwks = $this->jwks->jwksDecoratorFactory()->fromJwkDecorators(
8673
...$this->moduleConfig->getFederationSignatureKeyPairBag()->getAllPublicKeys(),
8774
)->jsonSerialize();
8875

8976
$payload = [
9077
ClaimsEnum::Iss->value => $this->moduleConfig->getIssuer(),
9178
ClaimsEnum::Iat->value => $currentTimestamp,
92-
ClaimsEnum::Jti->value => $this->helpers->random()->getIdentifier(),
79+
ClaimsEnum::Jti->value => $this->federation->helpers()->random()->string(),
9380
// This is entity configuration (statement about itself).
9481
ClaimsEnum::Sub->value => $this->moduleConfig->getIssuer(),
9582
ClaimsEnum::Exp->value => $this->helpers->dateTime()->getUtc()->add(
@@ -211,16 +198,21 @@ public function configuration(): Response
211198
// Remaining claims, add if / when ready.
212199
// * crit
213200

201+
$signingKeyPair = $this->moduleConfig
202+
->getFederationSignatureKeyPairBag()
203+
->getFirstOrFail();
204+
205+
$header = [
206+
ClaimsEnum::Kid->value => $signingKeyPair->getKeyPair()->getKeyId(),
207+
];
208+
214209
/** @psalm-suppress ArgumentTypeCoercion */
215210
$entityConfigurationToken = $this->federation->entityStatementFactory()->fromData(
216-
$this->jwk->jwkDecoratorFactory()->fromPkcs1Or8KeyFile(
217-
$this->moduleConfig->getFederationPrivateKeyPath(),
218-
),
219-
SignatureAlgorithmEnum::from($this->moduleConfig->getFederationSigner()->algorithmId()),
211+
$signingKeyPair->getKeyPair()->getPrivateKey(),
212+
$signingKeyPair->getSignatureAlgorithm(),
220213
$payload,
221214
$header,
222-
)
223-
->getToken();
215+
)->getToken();
224216

225217
$this->federationCache?->set(
226218
$entityConfigurationToken,
@@ -274,47 +266,60 @@ public function fetch(Request $request): Response
274266
);
275267
}
276268

277-
$builder = $this->jsonWebTokenBuilderService->getFederationJwtBuilder()
278-
->withHeader(ClaimsEnum::Typ->value, JwtTypesEnum::EntityStatementJwt->value)
279-
->relatedTo($subject)
280-
->expiresAt(
281-
$this->helpers->dateTime()->getUtc()->add($this->moduleConfig->getFederationEntityStatementDuration()),
282-
)->withClaim(
283-
ClaimsEnum::Jwks->value,
284-
$jwks,
285-
)
286-
->withClaim(
287-
ClaimsEnum::Metadata->value,
288-
[
289-
EntityTypesEnum::OpenIdRelyingParty->value => [
290-
ClaimsEnum::ClientName->value => $client->getName(),
291-
ClaimsEnum::ClientId->value => $client->getIdentifier(),
292-
ClaimsEnum::RedirectUris->value => $client->getRedirectUris(),
293-
ClaimsEnum::Scope->value => implode(' ', $client->getScopes()),
294-
ClaimsEnum::ClientRegistrationTypes->value => $client->getClientRegistrationTypes(),
295-
// Optional claims...
296-
...(array_filter(
297-
[
298-
ClaimsEnum::BackChannelLogoutUri->value => $client->getBackChannelLogoutUri(),
299-
ClaimsEnum::PostLogoutRedirectUris->value => $client->getPostLogoutRedirectUri(),
300-
],
301-
)),
302-
// TODO v7 mivanci Continue
303-
// https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata
304-
// https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#client-metadata
305-
],
269+
$currentTimestamp = $this->helpers->dateTime()->getUtc()->getTimestamp();
270+
271+
$payload = [
272+
ClaimsEnum::Iss->value => $this->moduleConfig->getIssuer(),
273+
ClaimsEnum::Iat->value => $currentTimestamp,
274+
ClaimsEnum::Jti->value => $this->helpers->random()->getIdentifier(),
275+
276+
ClaimsEnum::Sub->value => $subject,
277+
ClaimsEnum::Exp->value => $this->helpers->dateTime()->getUtc()->add(
278+
$this->moduleConfig->getFederationEntityStatementDuration(),
279+
)->getTimestamp(),
280+
ClaimsEnum::Jwks->value => $jwks,
281+
ClaimsEnum::Metadata->value => [
282+
EntityTypesEnum::OpenIdRelyingParty->value => [
283+
ClaimsEnum::ClientName->value => $client->getName(),
284+
ClaimsEnum::ClientId->value => $client->getIdentifier(),
285+
ClaimsEnum::RedirectUris->value => $client->getRedirectUris(),
286+
ClaimsEnum::Scope->value => implode(' ', $client->getScopes()),
287+
ClaimsEnum::ClientRegistrationTypes->value => $client->getClientRegistrationTypes(),
288+
// Optional claims...
289+
...(array_filter(
290+
[
291+
ClaimsEnum::BackChannelLogoutUri->value => $client->getBackChannelLogoutUri(),
292+
ClaimsEnum::PostLogoutRedirectUris->value => $client->getPostLogoutRedirectUri(),
293+
],
294+
)),
295+
// TODO v7 mivanci Continue
296+
// https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata
297+
// https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#client-metadata
306298
],
307-
);
299+
],
300+
];
308301

309302
// TODO v7 mivanci Continue
310303
// Note: claims which can be present in subordinate statements:
311304
// * metadata_policy
312305
// * constraints
313306
// * metadata_policy_crit
314307

315-
$jws = $this->jsonWebTokenBuilderService->getSignedFederationJwt($builder);
308+
$signingKeyPair = $this->moduleConfig
309+
->getFederationSignatureKeyPairBag()
310+
->getFirstOrFail();
311+
312+
313+
$header = [
314+
ClaimsEnum::Kid->value => $signingKeyPair->getKeyPair()->getKeyId(),
315+
];
316316

317-
$subordinateStatementToken = $jws->toString();
317+
$subordinateStatementToken = $this->federation->entityStatementFactory()->fromData(
318+
$signingKeyPair->getKeyPair()->getPrivateKey(),
319+
$signingKeyPair->getSignatureAlgorithm(),
320+
$payload,
321+
$header,
322+
)->getToken();
318323

319324
$this->federationCache?->set(
320325
$subordinateStatementToken,

‎src/Controllers/VerifiableCredentials/CredentialIssuerConfigurationController.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ public function configuration(): Response
4040
{
4141
// https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-issuer-metadata-p
4242

43-
$signer = $this->moduleConfig->getProtocolSigner();
43+
$signatureKeyPair = $this->moduleConfig->getProtocolSignatureKeyPairBag()->getFirstOrFail();
4444

4545
$credentialConfigurationsSupported = $this->moduleConfig->getCredentialConfigurationsSupported();
4646

@@ -50,12 +50,12 @@ public function configuration(): Response
5050
if (is_array($credentialConfiguration)) {
5151
// Draft 17
5252
$credentialConfiguration[ClaimsEnum::CredentialSigningAlgValuesSupported->value] = [
53-
$signer->algorithmId(),
53+
$signatureKeyPair->getSignatureAlgorithm()->value,
5454
];
5555
// Earlier drafts
5656
// TODO mivanci Delete CryptographicSuitesSupported once we are on the final draft.
5757
$credentialConfiguration[ClaimsEnum::CryptographicSuitesSupported->value] = [
58-
$signer->algorithmId(),
58+
$signatureKeyPair->getSignatureAlgorithm()->value,
5959
];
6060
$credentialConfigurationsSupported[$credentialConfigurationId] = $credentialConfiguration;
6161
}

‎src/Controllers/VerifiableCredentials/CredentialIssuerCredentialController.php‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717
use SimpleSAML\Module\oidc\Services\LoggerService;
1818
use SimpleSAML\Module\oidc\Utils\RequestParamsResolver;
1919
use SimpleSAML\Module\oidc\Utils\Routes;
20-
use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum;
2120
use SimpleSAML\OpenID\Codebooks\AtContextsEnum;
2221
use SimpleSAML\OpenID\Codebooks\ClaimsEnum;
2322
use SimpleSAML\OpenID\Codebooks\CredentialFormatIdentifiersEnum;
@@ -27,7 +26,6 @@
2726
use SimpleSAML\OpenID\Did;
2827
use SimpleSAML\OpenID\Exceptions\OpenId4VciProofException;
2928
use SimpleSAML\OpenID\Exceptions\OpenIdException;
30-
use SimpleSAML\OpenID\Jwk;
3129
use SimpleSAML\OpenID\VerifiableCredentials;
3230
use SimpleSAML\OpenID\VerifiableCredentials\OpenId4VciProof;
3331
use Symfony\Component\HttpFoundation\Request;
@@ -50,7 +48,6 @@ public function __construct(
5048
protected readonly Routes $routes,
5149
protected readonly PsrHttpBridge $psrHttpBridge,
5250
protected readonly VerifiableCredentials $verifiableCredentials,
53-
protected readonly Jwk $jwk,
5451
protected readonly LoggerService $loggerService,
5552
protected readonly RequestParamsResolver $requestParamsResolver,
5653
protected readonly UserRepository $userRepository,
@@ -592,18 +589,13 @@ public function credential(Request $request): Response
592589
$sub,
593590
);
594591

595-
$signingKey = $this->jwk->jwkDecoratorFactory()->fromPkcs1Or8KeyFile(
596-
$this->moduleConfig->getProtocolPrivateKeyPath(),
597-
null,
598-
);
592+
$protocolSignatureKeyPair = $this->moduleConfig
593+
->getProtocolSignatureKeyPairBag()
594+
->getFirstOrFail();
599595

600-
$publicKey = $this->jwk->jwkDecoratorFactory()->fromPkcs1Or8KeyFile(
601-
$this->moduleConfig->getProtocolCertPath(),
602-
null,
603-
[
604-
//ClaimsEnum::Use->value => 'sig',
605-
],
606-
);
596+
$signingKey = $protocolSignatureKeyPair->getKeyPair()->getPrivateKey();
597+
598+
$publicKey = $protocolSignatureKeyPair->getKeyPair()->getPublicKey();
607599

608600
$base64PublicKey = json_encode($publicKey->jwk()->all(), JSON_UNESCAPED_SLASHES);
609601
$base64PublicKey = Base64Url::encode($base64PublicKey);
@@ -613,7 +605,7 @@ public function credential(Request $request): Response
613605
$issuedAt = new \DateTimeImmutable();
614606

615607
$vcId = $this->moduleConfig->getIssuer() . '/vc/' . uniqid();
616-
$signatureAlgorithm = SignatureAlgorithmEnum::from($this->moduleConfig->getProtocolSigner()->algorithmId());
608+
$signatureAlgorithm = $protocolSignatureKeyPair->getSignatureAlgorithm();
617609

618610
$verifiableCredential = null;
619611

‎src/Factories/JwksFactory.php‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,7 @@
77
use SimpleSAML\Module\oidc\ModuleConfig;
88
use SimpleSAML\Module\oidc\Services\LoggerService;
99
use SimpleSAML\Module\oidc\Utils\FederationCache;
10-
use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmBag;
11-
use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum;
1210
use SimpleSAML\OpenID\Jwks;
13-
use SimpleSAML\OpenID\SupportedAlgorithms;
1411

1512
class JwksFactory
1613
{
@@ -27,14 +24,8 @@ public function __construct(
2724
*/
2825
public function build(): Jwks
2926
{
30-
$supportedAlgorithms = new SupportedAlgorithms(
31-
new SignatureAlgorithmBag(
32-
SignatureAlgorithmEnum::from($this->moduleConfig->getFederationSigner()->algorithmId()),
33-
),
34-
);
35-
3627
return new Jwks(
37-
supportedAlgorithms: $supportedAlgorithms,
28+
supportedAlgorithms: $this->moduleConfig->getSupportedAlgorithms(),
3829
maxCacheDuration: $this->moduleConfig->getFederationCacheMaxDurationForFetched(),
3930
cache: $this->federationCache?->cache,
4031
logger: $this->loggerService,

‎src/Factories/VerifiableCredentialsFactory.php‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,6 @@
66

77
use SimpleSAML\Module\oidc\ModuleConfig;
88
use SimpleSAML\Module\oidc\Services\LoggerService;
9-
use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmBag;
10-
use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum;
11-
use SimpleSAML\OpenID\SupportedAlgorithms;
129
use SimpleSAML\OpenID\VerifiableCredentials;
1310

1411
class VerifiableCredentialsFactory
@@ -25,23 +22,8 @@ public function __construct(
2522
*/
2623
public function build(): VerifiableCredentials
2724
{
28-
$supportedAlgorithms = new SupportedAlgorithms(
29-
new SignatureAlgorithmBag(
30-
SignatureAlgorithmEnum::from($this->moduleConfig->getProtocolSigner()->algorithmId()),
31-
SignatureAlgorithmEnum::RS256,
32-
SignatureAlgorithmEnum::RS384,
33-
SignatureAlgorithmEnum::RS512,
34-
SignatureAlgorithmEnum::ES256,
35-
SignatureAlgorithmEnum::ES384,
36-
SignatureAlgorithmEnum::ES512,
37-
SignatureAlgorithmEnum::PS256,
38-
SignatureAlgorithmEnum::PS384,
39-
SignatureAlgorithmEnum::PS512,
40-
),
41-
);
42-
4325
return new VerifiableCredentials(
44-
supportedAlgorithms: $supportedAlgorithms,
26+
supportedAlgorithms: $this->moduleConfig->getSupportedAlgorithms(),
4527
logger: $this->loggerService,
4628
);
4729
}

0 commit comments

Comments
 (0)