Repository: cxf Updated Branches: refs/heads/master 8185fdd55 -> 6af7d6ce1
Set up security context for JWT tokens if a public key algorithm is used Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/6af7d6ce Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/6af7d6ce Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/6af7d6ce Branch: refs/heads/master Commit: 6af7d6ce14342ce48cc9c2ed152cb3656ef91186 Parents: 8185fdd Author: Colm O hEigeartaigh <[email protected]> Authored: Tue Oct 20 17:27:00 2015 +0100 Committer: Colm O hEigeartaigh <[email protected]> Committed: Tue Oct 20 17:27:00 2015 +0100 ---------------------------------------------------------------------- .../rs/security/jose/common/JoseConstants.java | 11 +++++++++ .../security/jose/jwa/SignatureAlgorithm.java | 9 +++++++ .../jose/jaxrs/JwtAuthenticationFilter.java | 26 ++++++++++++++++++-- 3 files changed, 44 insertions(+), 2 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/6af7d6ce/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java index e0bf28b..f2c0b75 100644 --- a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java +++ b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java @@ -212,6 +212,17 @@ public final class JoseConstants { public static final String RSSEC_ENCRYPTION_REPORT_KEY_PROP = "rs.security.encryption.report.public.key"; public static final String RSSEC_ENCRYPTION_REPORT_KEY_ID_PROP = "rs.security.encryption.report.public.key.id"; + // + // JWT specific configuration + // + + /** + * Whether to allow unsigned JWT tokens as SecurityContext Principals. The default is false. + */ + public static final String ENABLE_UNSIGNED_JWT_PRINCIPAL = "rs.security.enable.unsigned-jwt.principal"; + + + private JoseConstants() { } http://git-wip-us.apache.org/repos/asf/cxf/blob/6af7d6ce/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/SignatureAlgorithm.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/SignatureAlgorithm.java b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/SignatureAlgorithm.java index 574e7c5..30f7bfd 100644 --- a/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/SignatureAlgorithm.java +++ b/rt/rs/security/jose/jose-core/src/main/java/org/apache/cxf/rs/security/jose/jwa/SignatureAlgorithm.java @@ -80,4 +80,13 @@ public enum SignatureAlgorithm { } + public static boolean isPublicKeyAlgorithm(SignatureAlgorithm sigAlgorithm) { + if (sigAlgorithm == null || sigAlgorithm.getJwaName() == null) { + return false; + } + + return sigAlgorithm.getJwaName().startsWith("RS") || sigAlgorithm.getJwaName().startsWith("PS") + || sigAlgorithm.getJwaName().startsWith("ES"); + } + } \ No newline at end of file http://git-wip-us.apache.org/repos/asf/cxf/blob/6af7d6ce/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java index 4942e0d..355bfb3 100644 --- a/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java +++ b/rt/rs/security/jose/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java @@ -30,8 +30,12 @@ import javax.ws.rs.core.HttpHeaders; import org.apache.cxf.common.logging.LogUtils; import org.apache.cxf.jaxrs.utils.JAXRSUtils; +import org.apache.cxf.message.Message; +import org.apache.cxf.message.MessageUtils; +import org.apache.cxf.rs.security.jose.common.JoseConstants; import org.apache.cxf.rs.security.jose.common.JoseException; import org.apache.cxf.rs.security.jose.common.JoseUtils; +import org.apache.cxf.rs.security.jose.jwa.SignatureAlgorithm; import org.apache.cxf.rs.security.jose.jwt.AbstractJoseJwtConsumer; import org.apache.cxf.rs.security.jose.jwt.JwtToken; import org.apache.cxf.rs.security.jose.jwt.JwtUtils; @@ -62,11 +66,29 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements if (securityContext != null) { JAXRSUtils.getCurrentMessage().put(SecurityContext.class, securityContext); } - } protected SecurityContext configureSecurityContext(JwtToken jwt) { - return new JwtTokenSecurityContext(jwt, roleClaim); + Message m = JAXRSUtils.getCurrentMessage(); + boolean enableUnsignedJwt = + MessageUtils.getContextualBoolean(m, JoseConstants.ENABLE_UNSIGNED_JWT_PRINCIPAL, false); + + // The token must be signed/verified with a public key to set up the security context, + // unless we directly configure otherwise + if (isVerifiedWithAPublicKey(jwt) || enableUnsignedJwt) { + return new JwtTokenSecurityContext(jwt, roleClaim); + } + return null; + } + + private boolean isVerifiedWithAPublicKey(JwtToken jwt) { + if (isJwsRequired()) { + String alg = (String)jwt.getHeader(JoseConstants.HEADER_ALGORITHM); + SignatureAlgorithm sigAlg = SignatureAlgorithm.getAlgorithm(alg); + return SignatureAlgorithm.isPublicKeyAlgorithm(sigAlg); + } + + return false; }
