[
https://issues.apache.org/jira/browse/SLING-13315?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105956#comment-18105956
]
Nicola Scendoni commented on SLING-13315:
-----------------------------------------
PR: https://github.com/apache/sling-org-apache-sling-auth-oauth-client/pull/51
> OidcAuthenticationHandler: make JWK set retrieval HTTP limits configurable
> (large JWK set fails ID token validation)
> --------------------------------------------------------------------------------------------------------------------
>
> Key: SLING-13315
> URL: https://issues.apache.org/jira/browse/SLING-13315
> Project: Sling
> Issue Type: Improvement
> Components: Extensions
> Reporter: Nicola Scendoni
> Priority: Major
>
> h4. Problem
> ID token validation in {{OidcAuthenticationHandler}} fails when the IdP's
> {{jwks_uri}} returns a JWK set larger than 50 KB. The error seen in the logs
> is:
> {noformat}
> *ERROR* org.apache.sling.auth.oauth_client.impl.OidcAuthenticationHandler
> Failed to validate token: Couldn't retrieve remote JWK set: Exceeded
> configured input limit of 51200 bytes
> com.nimbusds.jose.RemoteKeySourceException: Couldn't retrieve remote JWK set:
> Exceeded configured input limit of 51200 bytes
> {noformat}
> h4. Root cause
> {{validateIdToken(...)}} builds the validator with the constructor that
> relies on
> Nimbus' default {{DefaultResourceRetriever}}:
> {code:java}
> IDTokenValidator validator = new IDTokenValidator(issuer, clientID, jwsAlg,
> jwkSetURL);
> {code}
> That default retriever hard-codes {{RemoteJWKSet.DEFAULT_HTTP_SIZE_LIMIT = 50
> * 1024}}
> (51200 bytes), along with 500 ms connect/read timeouts. There is no way to
> raise these
> from an OSGi configuration, so an IdP that publishes a large key set (many
> rotated keys
> or large x5c certificate chains) cannot be used.
> Nimbus does expose a JVM system property
> ({{com.nimbusds.jose.jwk.source.RemoteJWKSet.defaultHttpSizeLimit}}), but
> that is a
> JVM-global setting and is not available in restricted/managed deployments
> where arbitrary
> {{-D}} flags cannot be set.
> h4. Proposed fix
> Add three OSGi configuration attributes to the handler and pass an explicitly
> configured
> {{DefaultResourceRetriever}} to the {{IDTokenValidator}}:
> * {{jwkSetHttpSizeLimit}} (default 51200) — max JWK set size in bytes, 0 =
> unlimited
> * {{jwkSetHttpConnectTimeout}} (default 500) — connect timeout in ms, 0 = no
> timeout
> * {{jwkSetHttpReadTimeout}} (default 500) — read timeout in ms, 0 = no timeout
> {code:java}
> DefaultResourceRetriever resourceRetriever =
> new DefaultResourceRetriever(jwkSetHttpConnectTimeout,
> jwkSetHttpReadTimeout, jwkSetHttpSizeLimit);
> IDTokenValidator validator =
> new IDTokenValidator(issuer, clientID, jwsAlg, jwkSetURL,
> resourceRetriever);
> {code}
> Defaults match the current Nimbus values, so existing deployments are
> unaffected unless
> the values are explicitly overridden.
> h4. Notes
> Also removes the standing {{// TODO specify HTTP response limits}} concern in
> the JWK
> retrieval path. A PR with unit tests (verifying a too-small limit fails and a
> raised
> limit succeeds) can be provided.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
