cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: ensure signer has key on OP creation

Browse source
This commit is contained in:
Livio Amstutz 2022-01-31 07:27:52 +01:00
parent 219ba4e038
commit e39146c98e
2 changed files with 24 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

2
pkg/op/op.go
View file

@ -125,8 +125,8 @@ func NewOpenIDProvider(ctx context.Context, config *Config, storage Storage, opO
} }
keyCh := make(chan jose.SigningKey) keyCh := make(chan jose.SigningKey)
o.signer = NewSigner(ctx, storage, keyCh)
go storage.GetSigningKey(ctx, keyCh) go storage.GetSigningKey(ctx, keyCh)
o.signer = NewSigner(ctx, storage, keyCh)
o.httpHandler = CreateRouter(o, o.interceptors...) o.httpHandler = CreateRouter(o, o.interceptors...)

18
pkg/op/signer.go
View file

@ -25,6 +25,12 @@ func NewSigner(ctx context.Context, storage AuthStorage, keyCh <-chan jose.Signi
storage: storage, storage: storage,
} }
select {
case <-ctx.Done():
return nil
case key := <-keyCh:
s.exchangeSigningKey(key)
}
go s.refreshSigningKey(ctx, keyCh) go s.refreshSigningKey(ctx, keyCh)
return s return s
@ -50,21 +56,25 @@ func (s *tokenSigner) refreshSigningKey(ctx context.Context, keyCh <-chan jose.S
case <-ctx.Done(): case <-ctx.Done():
return return
case key := <-keyCh: case key := <-keyCh:
s.exchangeSigningKey(key)
}
}
}
func (s *tokenSigner) exchangeSigningKey(key jose.SigningKey) {
s.alg = key.Algorithm s.alg = key.Algorithm
if key.Algorithm == "" || key.Key == nil { if key.Algorithm == "" || key.Key == nil {
s.signer = nil s.signer = nil
logging.Log("OP-DAvt4").Warn("signer has no key") logging.Log("OP-DAvt4").Warn("signer has no key")
continue return
} }
var err error var err error
s.signer, err = jose.NewSigner(key, &jose.SignerOptions{}) s.signer, err = jose.NewSigner(key, &jose.SignerOptions{})
if err != nil { if err != nil {
logging.Log("OP-pf32aw").WithError(err).Error("error creating signer") logging.Log("OP-pf32aw").WithError(err).Error("error creating signer")
continue return
} }
logging.Log("OP-agRf2").Info("signer exchanged signing key") logging.Log("OP-agRf2").Info("signer exchanged signing key")
}
}
} }
func (s *tokenSigner) SignatureAlgorithm() jose.SignatureAlgorithm { func (s *tokenSigner) SignatureAlgorithm() jose.SignatureAlgorithm {