filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

OIDC: Do not include symmetric keys in JWT keys

Browse Source
This commit is contained in:
mdecimus
2026-03-16 14:16:35 +01:00
parent e0105bc43b
commit 27dd5fc0ae
1 changed files with 20 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
crates/common/src/auth/oauth/config.rs
View File

@@ -83,13 +83,7 @@ impl OAuthConfig {
SignatureAlgorithm::None SignatureAlgorithm::None
| SignatureAlgorithm::HS256 | SignatureAlgorithm::HS256
| SignatureAlgorithm::HS384 | SignatureAlgorithm::HS384
| SignatureAlgorithm::HS512 => ( | SignatureAlgorithm::HS512 => (Secret::Bytes(signature_key.as_bytes().to_vec()), None),
Secret::Bytes(signature_key.as_bytes().to_vec()),
AlgorithmParameters::OctetKey(OctetKeyParameters {
key_type: OctetKeyType::Octet,
value: signature_key.as_bytes().to_vec(),
}),
),
SignatureAlgorithm::RS256 SignatureAlgorithm::RS256
| SignatureAlgorithm::RS384 | SignatureAlgorithm::RS384
| SignatureAlgorithm::RS512 | SignatureAlgorithm::RS512
@@ -100,13 +94,15 @@ impl OAuthConfig {
.map_err(|err| { .map_err(|err| {
bp.build_error(ObjectType::OidcProvider.singleton(), err); bp.build_error(ObjectType::OidcProvider.singleton(), err);
}) })
.map(|(secret, alg)| (secret, Some(alg)))
.unwrap_or_else(|_| { .unwrap_or_else(|_| {
( (
Secret::Bytes(rand_key.clone()), Secret::Bytes(rand_key.clone()),
AlgorithmParameters::OctetKey(OctetKeyParameters { AlgorithmParameters::OctetKey(OctetKeyParameters {
key_type: OctetKeyType::Octet, key_type: OctetKeyType::Octet,
value: rand_key, value: rand_key,
}), })
.into(),
) )
}), }),
SignatureAlgorithm::ES256 | SignatureAlgorithm::ES384 | SignatureAlgorithm::ES512 => { SignatureAlgorithm::ES256 | SignatureAlgorithm::ES384 | SignatureAlgorithm::ES512 => {
@@ -115,13 +111,15 @@ impl OAuthConfig {
.map_err(|err| { .map_err(|err| {
bp.build_error(ObjectType::OidcProvider.singleton(), err); bp.build_error(ObjectType::OidcProvider.singleton(), err);
}) })
.map(|(secret, alg)| (secret, Some(alg)))
.unwrap_or_else(|_| { .unwrap_or_else(|_| {
( (
Secret::Bytes(rand_key.clone()), Secret::Bytes(rand_key.clone()),
AlgorithmParameters::OctetKey(OctetKeyParameters { AlgorithmParameters::OctetKey(OctetKeyParameters {
key_type: OctetKeyType::Octet, key_type: OctetKeyType::Octet,
value: rand_key, value: rand_key,
}), })
.into(),
) )
}) })
} }
@@ -130,7 +128,9 @@ impl OAuthConfig {
let oidc_jwks = Resource { let oidc_jwks = Resource {
content_type: "application/json".into(), content_type: "application/json".into(),
contents: serde_json::to_string(&JWKSet { contents: serde_json::to_string(&JWKSet {
keys: vec![JWK { keys: algorithm
.into_iter()
.map(|algorithm| JWK {
common: CommonParameters { common: CommonParameters {
public_key_use: PublicKeyUse::Signature.into(), public_key_use: PublicKeyUse::Signature.into(),
algorithm: Algorithm::Signature(oidc_signature_algorithm).into(), algorithm: Algorithm::Signature(oidc_signature_algorithm).into(),
@@ -139,7 +139,8 @@ impl OAuthConfig {
}, },
algorithm, algorithm,
additional: (), additional: (),
}], })
.collect(),
}) })
.unwrap_or_default() .unwrap_or_default()
.into_bytes(), .into_bytes(),