Skip to content

Commit 88f4c47

Browse files
dushaniwdushaniw
committed
remove logic retrieving consumer app tenant domain to get resident IDP.
remove logic to get JWKS endpoint to validate signature.
1 parent bd90408 commit 88f4c47

File tree

3 files changed

+44
-82
lines changed

3 files changed

+44
-82
lines changed

‎components/apimgt/org.wso2.carbon.apimgt.impl/src/main/java/org/wso2/carbon/apimgt/impl/factory/KeyManagerHolder.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ private static JWTValidator getJWTValidator(KeyManagerConfiguration keyManagerCo
211211
tokenIssuerDto.setJwksConfigurationDTO(jwksConfigurationDTO);
212212
} else {
213213
X509Certificate x509Certificate =
214-
APIUtil.retrieveCertificateFromContent((String) certificateValue);
214+
APIUtil.retrieveCertificateFromURLEncodedContent((String) certificateValue);
215215
if (x509Certificate != null) {
216216
tokenIssuerDto.setCertificate(x509Certificate);
217217
}

‎components/apimgt/org.wso2.carbon.apimgt.impl/src/main/java/org/wso2/carbon/apimgt/impl/utils/APIUtil.java

+32-1
Original file line numberDiff line numberDiff line change
@@ -9229,7 +9229,14 @@ public static String getX509certificateContent(String certificate) {
92299229
return content.trim();
92309230
}
92319231

9232-
public static X509Certificate retrieveCertificateFromContent(String base64EncodedCertificate)
9232+
/**
9233+
* Util method to convert Base64 URL encoded certificate content to X509Certificate instance.
9234+
*
9235+
* @param base64EncodedCertificate Base64 URL encoded cert string
9236+
* @return javax.security.cert.X509Certificate
9237+
* @throws APIManagementException if an error occurs while retrieving from IDP
9238+
*/
9239+
public static X509Certificate retrieveCertificateFromURLEncodedContent(String base64EncodedCertificate)
92339240
throws APIManagementException {
92349241

92359242
if (base64EncodedCertificate != null) {
@@ -9253,6 +9260,30 @@ public static X509Certificate retrieveCertificateFromContent(String base64Encode
92539260
return null;
92549261
}
92559262

9263+
/**
9264+
* Util method to convert non URL encoded but base64 encoded certificate content to X509Certificate instance.
9265+
*
9266+
* @param base64EncodedCertificate Base64 encoded cert string (not URL encoded)
9267+
* @return javax.security.cert.X509Certificate
9268+
* @throws APIManagementException if an error occurs while retrieving from IDP
9269+
*/
9270+
public static X509Certificate retrieveCertificateFromContent(String base64EncodedCertificate)
9271+
throws APIManagementException {
9272+
9273+
if (base64EncodedCertificate != null) {
9274+
base64EncodedCertificate = APIUtil.getX509certificateContent(base64EncodedCertificate);
9275+
byte[] bytes = Base64.decodeBase64(base64EncodedCertificate.getBytes());
9276+
try (InputStream inputStream = new ByteArrayInputStream(bytes)) {
9277+
return X509Certificate.getInstance(inputStream);
9278+
} catch (IOException | javax.security.cert.CertificateException e) {
9279+
String msg = "Error while converting into X509Certificate";
9280+
log.error(msg, e);
9281+
throw new APIManagementException(msg, e);
9282+
}
9283+
}
9284+
return null;
9285+
}
9286+
92569287
/**
92579288
* Replace new RESTAPI Role mappings to tenant-conf.
92589289
*

‎components/apimgt/org.wso2.carbon.apimgt.rest.api.util/src/main/java/org/wso2/carbon/apimgt/rest/api/util/impl/OAuthJwtAuthenticatorImpl.java

+11-80
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,13 @@
2020
import com.nimbusds.jwt.JWTClaimsSet;
2121
import com.nimbusds.jwt.SignedJWT;
2222
import com.nimbusds.jwt.util.DateUtils;
23-
import org.apache.commons.codec.binary.Base64;
24-
import org.apache.commons.lang3.ArrayUtils;
2523
import org.apache.commons.lang3.StringUtils;
2624
import org.apache.commons.logging.Log;
2725
import org.apache.commons.logging.LogFactory;
2826
import org.apache.cxf.message.Message;
2927
import org.wso2.carbon.apimgt.api.APIManagementException;
3028
import org.wso2.carbon.apimgt.api.OAuthTokenInfo;
3129
import org.wso2.carbon.apimgt.common.gateway.constants.JWTConstants;
32-
import org.wso2.carbon.apimgt.common.gateway.dto.JWKSConfigurationDTO;
3330
import org.wso2.carbon.apimgt.common.gateway.dto.JWTValidationInfo;
3431
import org.wso2.carbon.apimgt.common.gateway.dto.TokenIssuerDto;
3532
import org.wso2.carbon.apimgt.impl.APIConstants;
@@ -48,12 +45,8 @@
4845
import org.wso2.carbon.context.PrivilegedCarbonContext;
4946
import org.wso2.carbon.identity.application.common.model.FederatedAuthenticatorConfig;
5047
import org.wso2.carbon.identity.application.common.model.IdentityProvider;
51-
import org.wso2.carbon.identity.application.common.model.IdentityProviderProperty;
5248
import org.wso2.carbon.identity.application.common.util.IdentityApplicationConstants;
5349
import org.wso2.carbon.identity.application.common.util.IdentityApplicationManagementUtil;
54-
import org.wso2.carbon.identity.oauth.common.exception.InvalidOAuthClientException;
55-
import org.wso2.carbon.identity.oauth2.IdentityOAuth2Exception;
56-
import org.wso2.carbon.identity.oauth2.util.OAuth2Util;
5750
import org.wso2.carbon.idp.mgt.IdentityProviderManagementException;
5851
import org.wso2.carbon.idp.mgt.IdentityProviderManager;
5952
import org.wso2.carbon.user.api.UserStoreException;
@@ -63,9 +56,6 @@
6356
import org.wso2.carbon.utils.multitenancy.MultitenantUtils;
6457

6558
import javax.security.cert.X509Certificate;
66-
import java.io.ByteArrayInputStream;
67-
import java.io.IOException;
68-
import java.io.InputStream;
6959
import java.net.MalformedURLException;
7060
import java.net.URL;
7161
import java.text.ParseException;
@@ -338,17 +328,7 @@ private JWTValidator validateAndGetJWTValidatorForIssuer(JWTClaimsSet jwtClaimsS
338328
+ tokenIssuer + ") does not match with the token issuer (" + tokenIssuers.keySet() + ")");
339329
}
340330
String residentTenantDomain = APIConstants.SUPER_TENANT_DOMAIN;
341-
String consumerKey = (String) jwtClaimsSet.getClaim("azp");
342-
if (consumerKey != null) {
343-
try {
344-
residentTenantDomain = OAuth2Util.getTenantDomainOfOauthApp(consumerKey);
345-
} catch (IdentityOAuth2Exception | InvalidOAuthClientException e) {
346-
throw new APIManagementException("JWT token issuer validation failed. Reason: Error while retrieving "
347-
+ "organization for the consumer app: " + consumerKey);
348-
}
349-
}
350-
IdentityProvider residentIDP
351-
= validateAndGetResidentIDPForIssuer(residentTenantDomain, tokenIssuer);
331+
IdentityProvider residentIDP = validateAndGetResidentIDPForIssuer(residentTenantDomain, tokenIssuer);
352332
if (residentIDP == null) {
353333
//invalid issuer. invalid token
354334
throw new APIManagementException("JWT token issuer validation failed. Reason: Resident Identity Provider "
@@ -357,47 +337,22 @@ private JWTValidator validateAndGetJWTValidatorForIssuer(JWTClaimsSet jwtClaimsS
357337
JWTValidator jwtValidator = new JWTValidatorImpl();
358338
TokenIssuerDto tokenIssuerDto = new TokenIssuerDto(tokenIssuer);
359339
if (residentIDP.getCertificate() != null) {
360-
tokenIssuerDto.setCertificate(retrieveCertificateFromContent(residentIDP.getCertificate()));
340+
X509Certificate certificate = APIUtil.retrieveCertificateFromContent(residentIDP.getCertificate());
341+
if (certificate == null) {
342+
throw new APIManagementException("JWT token issuer validation failed. Reason: Certificate for resident"
343+
+ " identity provider is not in base64 encoded format in organization: "
344+
+ residentTenantDomain);
345+
}
346+
tokenIssuerDto.setCertificate(certificate);
347+
361348
} else {
362-
JWKSConfigurationDTO jwksConfigurationDTO = new JWKSConfigurationDTO();
363-
jwksConfigurationDTO.setEnabled(true);
364-
jwksConfigurationDTO.setUrl(getJwksUriForIDP(residentIDP));
365-
tokenIssuerDto.setJwksConfigurationDTO(jwksConfigurationDTO);
349+
throw new APIManagementException("JWT token issuer validation failed. Reason: Certificate for resident" +
350+
" identity provider cannot be found for the organization: " + residentTenantDomain);
366351
}
367352
jwtValidator.loadTokenIssuerConfiguration(tokenIssuerDto);
368353
return jwtValidator;
369354
}
370355

371-
/**
372-
* Retrieve JWKS URI configured for the resident IDP.
373-
*
374-
* @param idp IdentityProvider
375-
* @return JWKS URI
376-
*/
377-
private String getJwksUriForIDP(IdentityProvider idp) {
378-
379-
String jwksUri = null;
380-
IdentityProviderProperty[] identityProviderProperties = idp.getIdpProperties();
381-
if (!ArrayUtils.isEmpty(identityProviderProperties)) {
382-
for (IdentityProviderProperty identityProviderProperty : identityProviderProperties) {
383-
if (StringUtils.equals(identityProviderProperty.getName(), JWKS_URI)) {
384-
jwksUri = identityProviderProperty.getValue();
385-
if (log.isDebugEnabled()) {
386-
log.debug("JWKS endpoint set for the identity provider : " + idp.getIdentityProviderName()
387-
+ ", jwks_uri : " + jwksUri);
388-
}
389-
break;
390-
} else {
391-
if (log.isDebugEnabled()) {
392-
log.debug("JWKS endpoint not specified for the identity provider : "
393-
+ idp.getIdentityProviderName());
394-
}
395-
}
396-
}
397-
}
398-
return jwksUri;
399-
}
400-
401356
/**
402357
* Retrieve token issuer details from deployment.toml file.
403358
*
@@ -465,28 +420,4 @@ private IdentityProvider validateAndGetResidentIDPForIssuer(String tenantDomain,
465420
}
466421
return jwtIssuer.equals(issuer) ? residentIdentityProvider : null;
467422
}
468-
469-
/**
470-
* Util method to convert base64 encoded certificate content to X509Certificate instance.
471-
*
472-
* @param base64EncodedCertificate Base64 encoded cert string (not URL encoded)
473-
* @return javax.security.cert.X509Certificate
474-
* @throws APIManagementException if an error occurs while retrieving from IDP
475-
*/
476-
private X509Certificate retrieveCertificateFromContent(String base64EncodedCertificate)
477-
throws APIManagementException {
478-
479-
if (base64EncodedCertificate != null) {
480-
base64EncodedCertificate = APIUtil.getX509certificateContent(base64EncodedCertificate);
481-
byte[] bytes = Base64.decodeBase64(base64EncodedCertificate.getBytes());
482-
try (InputStream inputStream = new ByteArrayInputStream(bytes)) {
483-
return X509Certificate.getInstance(inputStream);
484-
} catch (IOException | javax.security.cert.CertificateException e) {
485-
String msg = "Error while converting into X509Certificate";
486-
log.error(msg, e);
487-
throw new APIManagementException(msg, e);
488-
}
489-
}
490-
return null;
491-
}
492423
}

0 commit comments

Comments
 (0)