Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8a422ab

Browse files
louismariegaboritlouismariegaborit
committed
Support JWKS json from url
1 parent 7c833ee commit 8a422ab

File tree

5 files changed

+35
-14
lines changed

5 files changed

+35
-14
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/AccessToken/OidcTokenHandlerFactory.php

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313

1414
use Jose\Component\Core\Algorithm;
1515
use Jose\Component\Core\JWK;
16+
use Jose\Component\Core\JWKSet;
1617
use Symfony\Component\Config\Definition\Builder\NodeBuilder;
1718
use Symfony\Component\DependencyInjection\ChildDefinition;
1819
use Symfony\Component\DependencyInjection\ContainerBuilder;
@@ -46,9 +47,20 @@ public function create(ContainerBuilder $container, string $id, array|string $co
4647
);
4748
}
4849

49-
$tokenHandlerDefinition->replaceArgument(1, (new ChildDefinition('security.access_token_handler.oidc.jwk'))
50-
->replaceArgument(0, $config['key'])
51-
);
50+
if (!isset($config['jwks_url']) && !isset($config['key'])) {
51+
throw new LogicException('You should defined key or jwks_url parameter in configuration.');
52+
}
53+
54+
if (isset($config['jwks_url'])) {
55+
$jwksJson = file_get_contents($config['jwks_url']);
56+
} elseif (isset($config['key'])) {
57+
$jwksJson = json_encode((new JWKSet([JWK::createFromJson($config['key'])]))->jsonSerialize());
58+
}
59+
60+
$jwkSetDefinition = (new ChildDefinition('security.access_token_handler.oidc.jwk_set'))
61+
->replaceArgument(0, $jwksJson);
62+
63+
$tokenHandlerDefinition->replaceArgument(1, $jwkSetDefinition);
5264
}
5365

5466
public function getKey(): string
@@ -81,7 +93,9 @@ public function addConfiguration(NodeBuilder $node): void
8193
->end()
8294
->scalarNode('key')
8395
->info('JSON-encoded JWK used to sign the token (must contain a "kty" key).')
84-
->isRequired()
96+
->end()
97+
->scalarNode('jwks_url')
98+
->info('Url to retrieve JWKSet JSON-encoded (must contain a "keys" key).')
8599
->end()
86100
->end()
87101
->end()

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/SignatureAlgorithmFactory.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ public static function create(string $algorithm): AlgorithmInterface
2929
case 'ES256':
3030
case 'ES384':
3131
case 'ES512':
32+
case 'RS256':
3233
if (!class_exists(Algorithm::class.'\\'.$algorithm)) {
3334
throw new \LogicException(sprintf('You cannot use the "%s" signature algorithm since "web-token/jwt-signature-algorithm-ecdsa" is not installed. Try running "composer require web-token/jwt-signature-algorithm-ecdsa".', $algorithm));
3435
}

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security_authenticator_access_token.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
namespace Symfony\Component\DependencyInjection\Loader\Configurator;
1313

1414
use Jose\Component\Core\Algorithm;
15-
use Jose\Component\Core\JWK;
15+
use Jose\Component\Core\JWKSet;
1616
use Jose\Component\Signature\Algorithm\ES256;
1717
use Jose\Component\Signature\Algorithm\ES384;
1818
use Jose\Component\Signature\Algorithm\ES512;
@@ -75,11 +75,11 @@
7575
service('clock'),
7676
])
7777

78-
->set('security.access_token_handler.oidc.jwk', JWK::class)
78+
->set('security.access_token_handler.oidc.jwk_set', JWKSet::class)
7979
->abstract()
80-
->factory([JWK::class, 'createFromJson'])
80+
->factory([JWKSet::class, 'createFromJson'])
8181
->args([
82-
abstract_arg('signature key'),
82+
abstract_arg('signature keys'),
8383
])
8484

8585
->set('security.access_token_handler.oidc.signature', Algorithm::class)

‎src/Symfony/Component/Security/Http/AccessToken/Oidc/OidcTokenHandler.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
use Jose\Component\Checker\ClaimCheckerManager;
1616
use Jose\Component\Core\Algorithm;
1717
use Jose\Component\Core\AlgorithmManager;
18-
use Jose\Component\Core\JWK;
18+
use Jose\Component\Core\JWKSet;
1919
use Jose\Component\Signature\JWSTokenSupport;
2020
use Jose\Component\Signature\JWSVerifier;
2121
use Jose\Component\Signature\Serializer\CompactSerializer;
@@ -39,7 +39,7 @@ final class OidcTokenHandler implements AccessTokenHandlerInterface
3939

4040
public function __construct(
4141
private Algorithm $signatureAlgorithm,
42-
private JWK $jwk,
42+
private JWKSet $jwkSet,
4343
private string $audience,
4444
private array $issuers,
4545
private string $claim = 'sub',
@@ -62,7 +62,7 @@ public function getUserBadgeFrom(string $accessToken): UserBadge
6262
$claims = json_decode($jws->getPayload(), true);
6363

6464
// Verify the signature
65-
if (!$jwsVerifier->verifyWithKey($jws, $this->jwk, 0)) {
65+
if (!$jwsVerifier->verifyWithKeySet($jws, $this->jwkSet, 0)) {
6666
throw new InvalidSignatureException();
6767
}
6868

‎src/Symfony/Component/Security/Http/Tests/AccessToken/Oidc/OidcTokenHandlerTest.php

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313

1414
use Jose\Component\Core\AlgorithmManager;
1515
use Jose\Component\Core\JWK;
16+
use Jose\Component\Core\JWKSet;
1617
use Jose\Component\Signature\Algorithm\ES256;
1718
use Jose\Component\Signature\JWSBuilder;
1819
use Jose\Component\Signature\Serializer\CompactSerializer;
@@ -54,7 +55,7 @@ public function testGetsUserIdentifierFromSignedToken(string $claim, string $exp
5455

5556
$userBadge = (new OidcTokenHandler(
5657
new ES256(),
57-
$this->getJWK(),
58+
$this->getJWKSet(),
5859
self::AUDIENCE,
5960
['https://www.example.com'],
6061
$claim,
@@ -88,7 +89,7 @@ public function testThrowsAnErrorIfTokenIsInvalid(string $token)
8889

8990
(new OidcTokenHandler(
9091
new ES256(),
91-
$this->getJWK(),
92+
$this->getJWKSet(),
9293
self::AUDIENCE,
9394
['https://www.example.com'],
9495
'sub',
@@ -147,7 +148,7 @@ public function testThrowsAnErrorIfUserPropertyIsMissing()
147148

148149
(new OidcTokenHandler(
149150
new ES256(),
150-
self::getJWK(),
151+
self::getJWKSet(),
151152
self::AUDIENCE,
152153
['https://www.example.com'],
153154
'email',
@@ -177,4 +178,9 @@ private static function getJWK(): JWK
177178
'd' => 'iA_TV2zvftni_9aFAQwFO_9aypfJFCSpcCyevDvz220',
178179
]);
179180
}
181+
182+
private static function getJWKSet(): JWKSet
183+
{
184+
return new JWKSet([self::getJWK()]);
185+
}
180186
}

0 commit comments

Comments
 (0)