KeyStoreJwkKeyResolver implements SigningKeyResolver { @Override @SuppressWarnings("rawtypes") public Key resolveSigningKey(JwsHeader header, Claims claims) { String keyId = header.getKeyId(); if (keyId == null || keyId.isEmpty()) { if (LOG.isDebugEnabled()) { LOG.debug("KeyStoreJwkKeyResolver:resolveSigningKey: invalid key ID " + keyId); } return null; } String issuer = claims.getIssuer(); if (this.keyStore != null && issuer != null && !issuer.isEmpty()) { String[] ds = AthenzUtils.splitPrincipalName(issuer); if (ds == null) { if (LOG.isDebugEnabled()) { LOG.debug("KeyStoreJwkKeyResolver:resolveSigningKey: skip using KeyStore, invalid issuer " + issuer); } } else { String domain = ds[0]; String service = ds[1]; if (!SYS_AUTH_DOMAIN.equals(domain)) { LOG.debug("KeyStoreJwkKeyResolver:resolveSigningKey: skip using KeyStore, invalid domain " + domain); } else { String publicKey = this.keyStore.getPublicKey(domain, service, keyId); if (publicKey != null && !publicKey.isEmpty()) { try { if (LOG.isDebugEnabled()) { LOG.debug("KeyStoreJwkKeyResolver:resolveSigningKey: will use public key from key store: ({}, {}, {})", domain, service, keyId); } return Crypto.loadPublicKey(publicKey); } catch (Throwable t) { LOG.warn("KeyStoreJwkKeyResolver:resolveSigningKey: invalid public key format", t); } } } } } if (LOG.isDebugEnabled()) { LOG.debug("KeyStoreJwkKeyResolver:resolveSigningKey: will use public key from JWKS: ({})", keyId); } return this.jwksResolver.resolveSigningKey(header, claims); } KeyStoreJwkKeyResolver(KeyStore keyStore, String url, SSLContext sslContext); @Override @SuppressWarnings("rawtypes") Key resolveSigningKey(JwsHeader header, Claims claims); @Override @SuppressWarnings("rawtypes") Key resolveSigningKey(JwsHeader header, String plaintext);  }
@Test public void testResolveSigningKey() throws Exception { KeyStore keyStoreMock = Mockito.spy(baseKeyStore); SigningKeyResolver jwksResolverMock = Mockito.spy(basejwksResolver); KeyStoreJwkKeyResolver resolver = new KeyStoreJwkKeyResolver(null, "file: Field keyStoreField = resolver.getClass().getDeclaredField("keyStore"); keyStoreField.setAccessible(true); Field providerField = resolver.getClass().getDeclaredField("jwksResolver"); providerField.setAccessible(true); providerField.set(resolver, jwksResolverMock); DefaultJwsHeader jwsHeader = new DefaultJwsHeader(); DefaultClaims claims = new DefaultClaims(); PublicKey pk11 = Mockito.spy(basePublicKey); Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(pk11); jwsHeader.setKeyId("11"); claims.setIssuer(null); assertSame(resolver.resolveSigningKey(jwsHeader, claims), pk11); keyStoreField.set(resolver, keyStoreMock); PublicKey pk21 = Mockito.spy(basePublicKey); Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(pk21); jwsHeader.setKeyId("21"); claims.setIssuer(null); assertSame(resolver.resolveSigningKey(jwsHeader, claims), pk21); PublicKey pk22 = Mockito.spy(basePublicKey); Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(pk22); jwsHeader.setKeyId("22"); claims.setIssuer(""); assertSame(resolver.resolveSigningKey(jwsHeader, claims), pk22); PublicKey pk23 = Mockito.spy(basePublicKey); Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(pk23); jwsHeader.setKeyId("23"); claims.setIssuer("domain23-----service23"); assertSame(resolver.resolveSigningKey(jwsHeader, claims), pk23); PublicKey pk24 = Mockito.spy(basePublicKey); Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(pk24); jwsHeader.setKeyId("24"); claims.setIssuer("domain24.service24"); assertSame(resolver.resolveSigningKey(jwsHeader, claims), pk24); PublicKey pk31 = null; try (PemReader reader = new PemReader(new FileReader(this.classLoader.getResource("jwt_public.key").getFile()))) { pk31 = KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(reader.readPemObject().getContent())); } Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(pk31); Mockito.when(keyStoreMock.getPublicKey("sys.auth", "service31", "31")).thenReturn("-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAy3c3TEePZZPaxqNU2xV4\nortsXrw1EXTNQj2QUgL8UOPaQS0lbHJtD1cbcCFnzfXRXTOGqh8l+XWTRIOlt4yU\n+mEhgR0/JKILTPwmS0fj3D1PT6IjZShuNyd4USVdcjfCRBRb9ExIptJyeTTUu0Uu\njWNEcGOWAkUZcsonmiEz7bIMVkGy5uYnWGbsKP51Zf/PFMb96RcHeE0ZUitIB4YK\n1bgHLyAEBJIka5mRC/jWq/mlq3jiP5RaVWbzQiJbrjuYWd1Vps/xnrABx6/4Ft/M\n0AnSQN0SYjc/nWT1yGPpCwtWmWUU5NNHd+w6TdgOjdu00wownwblovtEYED+rncb\n913qfBM98kNHyj357BSzlvhiwEH5Ayo9DTnx1j9HuJGZXzymVypuQXLu/tkHMEt+\nc4kytKJNi6MLiauy9xtXGLXgOvZUM8V0Z27Z6CTfCzWZ0nwnEWDdH+NJyusL6pJg\nEGUBh6E9fdJInV7YOCF+P9/19imPHrZ0blTXK1TDfKS/pCLOXO/OmmH+p+UxQ77O\npeP5wlt5Jem0ErSisl/Qxhh1OtJcLwFdA7uC7rOTMrSEGLO++5+CatsXj7BEK2l+\n3As8fJEkoWXd1+4KOUMfV/fnT/z6U8+bcsYn0nvWPl8XuMbwNWjqHYgqhl1RLA7M\n17HCydWCF50HI2XojtGgRN0CAwEAAQ==\n-----END PUBLIC KEY-----\n"); jwsHeader.setKeyId("31"); claims.setIssuer("sys.auth.service31"); assertEquals(resolver.resolveSigningKey(jwsHeader, claims), pk31); PublicKey pk32 = Mockito.spy(basePublicKey); Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(pk32); Mockito.when(keyStoreMock.getPublicKey("sys.auth", "service32", "32")).thenReturn(null); jwsHeader.setKeyId("32"); claims.setIssuer("sys.auth.service32"); assertSame(resolver.resolveSigningKey(jwsHeader, claims), pk32); PublicKey pk33 = Mockito.spy(basePublicKey); Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(pk33); Mockito.when(keyStoreMock.getPublicKey("sys.auth", "service33", "33")).thenReturn(""); jwsHeader.setKeyId("33"); claims.setIssuer("sys.auth.service33"); assertSame(resolver.resolveSigningKey(jwsHeader, claims), pk33); PublicKey pk34 = Mockito.spy(basePublicKey); Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(pk34); Mockito.when(keyStoreMock.getPublicKey("sys.auth", "service34", "34")).thenReturn("-----BEGIN PUBLIC KEY-----\ninvalid\n-----END PUBLIC KEY-----\n"); jwsHeader.setKeyId("34"); claims.setIssuer("sys.auth.service34"); assertSame(resolver.resolveSigningKey(jwsHeader, claims), pk34); jwsHeader.setKeyId("41"); claims.setIssuer("sys.auth.service41"); Mockito.when(jwksResolverMock.resolveSigningKey(jwsHeader, claims)).thenReturn(null); Mockito.when(keyStoreMock.getPublicKey("sys.auth", "service41", "41")).thenReturn(null); assertNull(resolver.resolveSigningKey(jwsHeader, claims)); jwsHeader.setKeyId(null); claims.setIssuer(null); assertNull(resolver.resolveSigningKey(jwsHeader, claims)); jwsHeader.setKeyId(""); claims.setIssuer(null); assertNull(resolver.resolveSigningKey(jwsHeader, claims)); }
@Test public void testResolveSigningKeyForJwe() throws MalformedURLException { KeyStoreJwkKeyResolver resolver = new KeyStoreJwkKeyResolver(null, "file: assertNull(resolver.resolveSigningKey(null, (String) null)); assertNull(resolver.resolveSigningKey(null, "")); assertNull(resolver.resolveSigningKey(baseJwsHeader, "plaintext")); }