cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(op): JWT profile verifier with keyset

Browse source 
feat(op): JWT profile verifier with keyset
This commit is contained in:
Stefan Benz 2023-11-21 10:26:57 +01:00 • committed by GitHub
commit a8ef8de87b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
pkg/op/verifier_jwt_profile.go
View file

@ -17,11 +17,21 @@ import (
type JWTProfileVerifier struct { type JWTProfileVerifier struct {
oidc.Verifier oidc.Verifier
Storage JWTProfileKeyStorage Storage JWTProfileKeyStorage
keySet oidc.KeySet
CheckSubject func(request *oidc.JWTTokenRequest) error CheckSubject func(request *oidc.JWTTokenRequest) error
} }
// NewJWTProfileVerifier creates a oidc.Verifier for JWT Profile assertions (authorization grant and client authentication) // NewJWTProfileVerifier creates a oidc.Verifier for JWT Profile assertions (authorization grant and client authentication)
func NewJWTProfileVerifier(storage JWTProfileKeyStorage, issuer string, maxAgeIAT, offset time.Duration, opts ...JWTProfileVerifierOption) *JWTProfileVerifier { func NewJWTProfileVerifier(storage JWTProfileKeyStorage, issuer string, maxAgeIAT, offset time.Duration, opts ...JWTProfileVerifierOption) *JWTProfileVerifier {
return newJWTProfileVerifier(storage, nil, issuer, maxAgeIAT, offset, opts...)
}
// NewJWTProfileVerifierKeySet creates a oidc.Verifier for JWT Profile assertions (authorization grant and client authentication)
func NewJWTProfileVerifierKeySet(keySet oidc.KeySet, issuer string, maxAgeIAT, offset time.Duration, opts ...JWTProfileVerifierOption) *JWTProfileVerifier {
return newJWTProfileVerifier(nil, keySet, issuer, maxAgeIAT, offset, opts...)
}
func newJWTProfileVerifier(storage JWTProfileKeyStorage, keySet oidc.KeySet, issuer string, maxAgeIAT, offset time.Duration, opts ...JWTProfileVerifierOption) *JWTProfileVerifier {
j := &JWTProfileVerifier{ j := &JWTProfileVerifier{
Verifier: oidc.Verifier{ Verifier: oidc.Verifier{
Issuer: issuer, Issuer: issuer,
@ -29,6 +39,7 @@ func NewJWTProfileVerifier(storage JWTProfileKeyStorage, issuer string, maxAgeIA
Offset: offset, Offset: offset,
}, },
Storage: storage, Storage: storage,
keySet: keySet,
CheckSubject: SubjectIsIssuer, CheckSubject: SubjectIsIssuer,
} }
@ -78,7 +89,10 @@ func VerifyJWTAssertion(ctx context.Context, assertion string, v *JWTProfileVeri
return nil, err return nil, err
} }
keySet := &jwtProfileKeySet{storage: v.Storage, clientID: request.Issuer} keySet := v.keySet
if keySet == nil {
keySet = &jwtProfileKeySet{storage: v.Storage, clientID: request.Issuer}
}
if err = oidc.CheckSignature(ctx, assertion, payload, request, nil, keySet); err != nil { if err = oidc.CheckSignature(ctx, assertion, payload, request, nil, keySet); err != nil {
return nil, err return nil, err
} }