Skip to content

Commit 3b63f59

Browse files
cicnavicicnavi
committed
WIP
1 parent 9a4e9e3 commit 3b63f59

File tree

16 files changed

+158
-116
lines changed

16 files changed

+158
-116
lines changed

‎config/module_oidc.php.dist‎

Lines changed: 74 additions & 67 deletions
Large diffs are not rendered by default.

‎docker/ssp/module_oidc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
ModuleConfig::OPTION_TOKEN_REFRESH_TOKEN_TTL => 'P1M',
2222
ModuleConfig::OPTION_TOKEN_ACCESS_TOKEN_TTL => 'PT1H',
2323

24-
ModuleConfig::OPTION_CONNECT_SIGNATURE_KEY_PAIRS => [
24+
ModuleConfig::OPTION_PROTOCOL_SIGNATURE_KEY_PAIRS => [
2525
[
2626
ModuleConfig::KEY_ALGORITHM => \SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum::RS256,
2727
ModuleConfig::KEY_PRIVATE_KEY_FILENAME => ModuleConfig::DEFAULT_PKI_PRIVATE_KEY_FILENAME,

‎src/Controllers/JwksController.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ public function __invoke(): JsonResponse
3838
{
3939
return new JsonResponse(
4040
$this->jwks->jwksDecoratorFactory()->fromJwkDecorators(
41-
...$this->moduleConfig->getConnectSignatureKeyPairBag()->getAllPublicKeys(),
41+
...$this->moduleConfig->getProtocolSignatureKeyPairBag()->getAllPublicKeys(),
4242
)->jsonSerialize(),
4343
);
4444
}

‎src/Entities/AccessTokenEntity.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ public function toString(): ?string
156156
*/
157157
protected function convertToJWT(): ParsedJws
158158
{
159-
$protocolSignatureKeyPair = $this->moduleConfig->getConnectSignatureKeyPairBag()->getFirstOrFail();
159+
$protocolSignatureKeyPair = $this->moduleConfig->getProtocolSignatureKeyPairBag()->getFirstOrFail();
160160
$currentTimestamp = $this->jws->helpers()->dateTime()->getUtc()->getTimestamp();
161161

162162
$payload = array_filter([

‎src/Factories/CryptKeyFactory.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ public function buildPublicKey(): CryptKey
5555
*/
5656
protected function getDefaultProtocolSignatureKeyPairConfig(): array
5757
{
58-
$defaultProtocolKeyPair = $this->moduleConfig->getConnectSignatureKeyPairs();
58+
$defaultProtocolKeyPair = $this->moduleConfig->getProtocolSignatureKeyPairs();
5959

6060
/** @psalm-suppress MixedAssignment */
6161
$defaultProtocolKeyPair = $defaultProtocolKeyPair[array_key_first($defaultProtocolKeyPair)];

‎src/ModuleConfig.php‎

Lines changed: 50 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ class ModuleConfig
110110
final public const OPTION_VCI_ALLOW_NON_REGISTERED_CLIENTS = 'vci_allow_non_registered_clients';
111111
final public const OPTION_VCI_ALLOWED_REDIRECT_URI_PREFIXES_FOR_NON_REGISTERED_CLIENTS =
112112
'vci_allowed_redirect_uri_prefixes_for_non_registered_clients';
113-
final public const OPTION_CONNECT_SIGNATURE_KEY_PAIRS = 'connect_signature_key_pairs';
113+
final public const OPTION_PROTOCOL_SIGNATURE_KEY_PAIRS = 'protocol_signature_key_pairs';
114114
final public const OPTION_FEDERATION_SIGNATURE_KEY_PAIRS = 'federation_signature_key_pairs';
115115
final public const OPTION_TIMESTAMP_VALIDATION_LEEWAY = 'timestamp_validation_leeway';
116116
final public const OPTION_VCI_SIGNATURE_KEY_PAIRS = 'vci_signature_key_pairs';
@@ -144,10 +144,11 @@ class ModuleConfig
144144
* @var Configuration SimpleSAMLphp configuration instance.
145145
*/
146146
private readonly Configuration $sspConfig;
147-
protected ?SignatureKeyPairBag $connectSignatureKeyPairBag = null;
148-
protected ?SignatureKeyPairConfigBag $connectSignatureKeyPairConfigBag = null;
147+
protected ?SignatureKeyPairBag $protocolSignatureKeyPairBag = null;
148+
protected ?SignatureKeyPairConfigBag $protocolSignatureKeyPairConfigBag = null;
149149
protected ?SignatureKeyPairBag $federationSignatureKeyPairBag = null;
150150
protected ?SignatureKeyPairBag $vciSignatureKeyPairBag = null;
151+
protected ?SignatureKeyPairConfigBag $vciSignatureKeyPairConfigBag = null;
151152

152153
/**
153154
* @throws \Exception
@@ -377,10 +378,10 @@ public function getSupportedSerializers(): SupportedSerializers
377378
* @throws ConfigurationError
378379
* @return non-empty-array
379380
*/
380-
public function getConnectSignatureKeyPairs(): array
381+
public function getProtocolSignatureKeyPairs(): array
381382
{
382383

383-
$signatureKeyPairs = $this->config()->getArray(ModuleConfig::OPTION_CONNECT_SIGNATURE_KEY_PAIRS);
384+
$signatureKeyPairs = $this->config()->getArray(ModuleConfig::OPTION_PROTOCOL_SIGNATURE_KEY_PAIRS);
384385

385386
if (empty($signatureKeyPairs)) {
386387
throw new ConfigurationError('At least one protocol signature key-pair pair must be provided.');
@@ -393,30 +394,30 @@ public function getConnectSignatureKeyPairs(): array
393394
* @throws \SimpleSAML\Error\ConfigurationError
394395
* @psalm-suppress MixedAssignment, ArgumentTypeCoercion
395396
*/
396-
public function getConnectSignatureKeyPairConfigBag(): SignatureKeyPairConfigBag
397+
public function getProtocolSignatureKeyPairConfigBag(): SignatureKeyPairConfigBag
397398
{
398-
if ($this->connectSignatureKeyPairConfigBag instanceof SignatureKeyPairConfigBag) {
399-
return $this->connectSignatureKeyPairConfigBag;
399+
if ($this->protocolSignatureKeyPairConfigBag instanceof SignatureKeyPairConfigBag) {
400+
return $this->protocolSignatureKeyPairConfigBag;
400401
}
401402

402-
return $this->connectSignatureKeyPairConfigBag = $this->getSignatureKeyPairConfigBag(
403-
$this->getConnectSignatureKeyPairs(),
403+
return $this->protocolSignatureKeyPairConfigBag = $this->getSignatureKeyPairConfigBag(
404+
$this->getProtocolSignatureKeyPairs(),
404405
);
405406
}
406407

407408
/**
408409
* @throws \SimpleSAML\Error\ConfigurationError
409410
* @psalm-suppress MixedAssignment, ArgumentTypeCoercion
410411
*/
411-
public function getConnectSignatureKeyPairBag(): SignatureKeyPairBag
412+
public function getProtocolSignatureKeyPairBag(): SignatureKeyPairBag
412413
{
413-
if ($this->connectSignatureKeyPairBag instanceof SignatureKeyPairBag) {
414-
return $this->connectSignatureKeyPairBag;
414+
if ($this->protocolSignatureKeyPairBag instanceof SignatureKeyPairBag) {
415+
return $this->protocolSignatureKeyPairBag;
415416
}
416417

417-
return $this->connectSignatureKeyPairBag = $this->valueAbstracts
418+
return $this->protocolSignatureKeyPairBag = $this->valueAbstracts
418419
->signatureKeyPairBagFactory()
419-
->fromConfig($this->getConnectSignatureKeyPairConfigBag());
420+
->fromConfig($this->getProtocolSignatureKeyPairConfigBag());
420421
}
421422

422423
/**
@@ -836,6 +837,39 @@ public function getVerifiableCredentialEnabled(): bool
836837
return $this->config()->getOptionalBoolean(self::OPTION_VCI_ENABLED, false);
837838
}
838839

840+
841+
/**
842+
* @throws ConfigurationError
843+
* @return non-empty-array
844+
*/
845+
public function getVciSignatureKeyPairs(): array
846+
{
847+
848+
$signatureKeyPairs = $this->config()->getArray(ModuleConfig::OPTION_VCI_SIGNATURE_KEY_PAIRS);
849+
850+
if (empty($signatureKeyPairs)) {
851+
throw new ConfigurationError('At least one VCI signature key-pair pair must be provided.');
852+
}
853+
854+
return $signatureKeyPairs;
855+
}
856+
857+
858+
/**
859+
* @throws \SimpleSAML\Error\ConfigurationError
860+
* @psalm-suppress MixedAssignment, ArgumentTypeCoercion
861+
*/
862+
public function getVciSignatureKeyPairConfigBag(): SignatureKeyPairConfigBag
863+
{
864+
if ($this->vciSignatureKeyPairConfigBag instanceof SignatureKeyPairConfigBag) {
865+
return $this->vciSignatureKeyPairConfigBag;
866+
}
867+
868+
return $this->vciSignatureKeyPairConfigBag = $this->getSignatureKeyPairConfigBag(
869+
$this->getVciSignatureKeyPairs(),
870+
);
871+
}
872+
839873
/**
840874
* @throws \SimpleSAML\Error\ConfigurationError
841875
* @psalm-suppress MixedAssignment, ArgumentTypeCoercion
@@ -848,7 +882,7 @@ public function getVciSignatureKeyPairBag(): SignatureKeyPairBag
848882

849883
return $this->vciSignatureKeyPairBag = $this->valueAbstracts
850884
->signatureKeyPairBagFactory()
851-
->fromConfig($this->getConnectSignatureKeyPairConfigBag());
885+
->fromConfig($this->getVciSignatureKeyPairConfigBag());
852886
}
853887

854888
public function getVciCredentialConfigurationsSupported(): array

‎src/Server/RequestRules/Rules/IdTokenHintRule.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ public function checkRule(
6666
}
6767

6868
$jwks = $this->jwks->jwksDecoratorFactory()->fromJwkDecorators(
69-
...$this->moduleConfig->getConnectSignatureKeyPairBag()->getAllPublicKeys(),
69+
...$this->moduleConfig->getProtocolSignatureKeyPairBag()->getAllPublicKeys(),
7070
)->jsonSerialize();
7171

7272
$idTokenHint = $this->core->idTokenFactory()->fromToken($idTokenHintParam);

‎src/Server/Validators/BearerTokenValidator.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ public function validateAuthorization(ServerRequestInterface $request): ServerRe
8484
try {
8585
// Attempt to validate the JWT
8686
$jwks = $this->jwks->jwksDecoratorFactory()->fromJwkDecorators(
87-
...$this->moduleConfig->getConnectSignatureKeyPairBag()->getAllPublicKeys(),
87+
...$this->moduleConfig->getProtocolSignatureKeyPairBag()->getAllPublicKeys(),
8888
)->jsonSerialize();
8989
$token->verifyWithKeySet($jwks);
9090
} catch (JwsException) {

‎src/Services/IdTokenBuilder.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public function buildFor(
5050
throw new RuntimeException('Client is expected to be instance of ' . ClientEntity::class);
5151
}
5252

53-
$protocolSignatureKeyPairBag = $this->moduleConfig->getConnectSignatureKeyPairBag();
53+
$protocolSignatureKeyPairBag = $this->moduleConfig->getProtocolSignatureKeyPairBag();
5454
$protocolSignatureKeyPair = $protocolSignatureKeyPairBag->getFirstOrFail();
5555

5656
// ID Token signing algorithm that the client wants.

‎src/Services/LogoutTokenBuilder.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ public function __construct(
3535
*/
3636
public function forRelyingPartyAssociation(RelyingPartyAssociationInterface $relyingPartyAssociation): string
3737
{
38-
$protocolSignatureKeyPairBag = $this->moduleConfig->getConnectSignatureKeyPairBag();
38+
$protocolSignatureKeyPairBag = $this->moduleConfig->getProtocolSignatureKeyPairBag();
3939
$protocolSignatureKeyPair = $protocolSignatureKeyPairBag->getFirstOrFail();
4040

4141
// ID Token signing algorithm that the client wants. As per spec, the

0 commit comments

Comments
 (0)