Skip to content

Commit 9722011

Browse files
jimmy1wujimmy1wu
authored
Merge pull request #27701 from jimmy1wu/jwtRunAsServer
runAsServer before signing/verifying jws and encrypting/decrypting jwe
2 parents 582d8e3 + 6dd3ddf commit 9722011

File tree

14 files changed

+84
-27
lines changed

14 files changed

+84
-27
lines changed

‎dev/com.ibm.ws.security.jwt/bnd.bnd‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#*******************************************************************************
2-
# Copyright (c) 2017, 2023 IBM Corporation and others.
2+
# Copyright (c) 2017, 2024 IBM Corporation and others.
33
# All rights reserved. This program and the accompanying materials
44
# are made available under the terms of the Eclipse Public License 2.0
55
# which accompanies this distribution, and is available at
@@ -75,7 +75,8 @@ Import-Package: \
7575
com.ibm.ws.ssl;version="[1.0.0, 2.0)";resolution:=optional, \
7676
com.ibm.ws.security.wim;version="[1.0.0, 2.0)";resolution:=optional, \
7777
com.ibm.wsspi.security.wim.model;version="[1.0.0, 2.0)";resolution:=optional, \
78-
com.ibm.ws.kernel.productinfo
78+
com.ibm.ws.kernel.productinfo, \
79+
com.ibm.ws.kernel.security.thread
7980

8081
Private-Package: \
8182
com.ibm.ws.security.jwt.internal.*, \
@@ -137,7 +138,8 @@ instrument.classesExcludes: com/ibm/ws/security/jwt/internal/resources/*.class
137138
io.openliberty.com.google.gson;version=latest, \
138139
com.ibm.ws.org.osgi.annotation.versioning;version=latest, \
139140
com.ibm.json4j;version=latest, \
140-
com.ibm.ws.kernel.boot.core;version=latest
141+
com.ibm.ws.kernel.boot.core;version=latest, \
142+
com.ibm.ws.kernel.security.thread;version=latest
141143

142144
-testpath: \
143145
../build.sharedResources/lib/junit/old/junit.jar;version=file, \

‎dev/com.ibm.ws.security.jwt/src/com/ibm/ws/security/jwt/internal/ConsumerUtil.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2016, 2023 IBM Corporation and others.
2+
* Copyright (c) 2016, 2024 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -45,6 +45,7 @@
4545
import com.ibm.websphere.security.jwt.JwtToken;
4646
import com.ibm.websphere.security.jwt.KeyException;
4747
import com.ibm.websphere.security.jwt.KeyStoreServiceException;
48+
import com.ibm.ws.kernel.security.thread.ThreadIdentityManager;
4849
import com.ibm.ws.security.common.crypto.KeyAlgorithmChecker;
4950
import com.ibm.ws.security.common.jwk.impl.JwKRetriever;
5051
import com.ibm.ws.security.common.time.TimeUtils;
@@ -855,6 +856,7 @@ void validateAlgorithm(String requiredAlg, String tokenAlg) throws InvalidTokenE
855856

856857
void processJwtContextWithConsumer(JwtConsumer jwtConsumer, JwtContext jwtContext)
857858
throws InvalidTokenException, InvalidJwtException {
859+
Object token = ThreadIdentityManager.runAsServer();
858860
try {
859861
jwtConsumer.processContext(jwtContext);
860862
} catch (InvalidJwtSignatureException e) {
@@ -869,6 +871,8 @@ void processJwtContextWithConsumer(JwtConsumer jwtConsumer, JwtContext jwtContex
869871
// message
870872
throw e;
871873
}
874+
} finally {
875+
ThreadIdentityManager.reset(token);
872876
}
873877
}
874878

‎dev/com.ibm.ws.security.jwt/src/com/ibm/ws/security/jwt/utils/JweHelper.java‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2020, 2022 IBM Corporation and others.
2+
* Copyright (c) 2020, 2024 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -32,6 +32,7 @@
3232
import com.ibm.websphere.security.jwt.InvalidTokenException;
3333
import com.ibm.websphere.security.jwt.KeyException;
3434
import com.ibm.ws.ffdc.annotation.FFDCIgnore;
35+
import com.ibm.ws.kernel.security.thread.ThreadIdentityManager;
3536
import com.ibm.ws.security.common.jwk.impl.JwKRetriever;
3637
import com.ibm.ws.security.common.jwk.impl.JwkKidBuilder;
3738
import com.ibm.ws.security.jwt.config.JwtConfig;
@@ -169,7 +170,13 @@ static String getJwePayload(String jweString, @Sensitive Key decryptionKey) thro
169170
JsonWebEncryption jwe = new JsonWebEncryption();
170171
jwe.setCompactSerialization(jweString);
171172
jwe.setKey(decryptionKey);
172-
String payload = jwe.getPayload();
173+
String payload = null;
174+
Object token = ThreadIdentityManager.runAsServer();
175+
try {
176+
payload = jwe.getPayload();
177+
} finally {
178+
ThreadIdentityManager.reset(token);
179+
}
173180
if (isJws(payload)) {
174181
verifyContentType(jwe);
175182
}
@@ -317,10 +324,13 @@ static String getContentEncryptionAlgorithmFromConfig(JwtConfig jwtConfig) {
317324

318325
static String getJwtString(JsonWebEncryption jwe) throws JwtTokenException {
319326
String jwt = null;
327+
Object token = ThreadIdentityManager.runAsServer();
320328
try {
321329
jwt = jwe.getCompactSerialization();
322330
} catch (Exception e) {
323331
throw new JwtTokenException(e.getLocalizedMessage(), e);
332+
} finally {
333+
ThreadIdentityManager.reset(token);
324334
}
325335
return jwt;
326336
}

‎dev/com.ibm.ws.security.jwt/src/com/ibm/ws/security/jwt/utils/JwsSigner.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2016 IBM Corporation and others.
2+
* Copyright (c) 2016, 2024 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -20,6 +20,7 @@
2020
import org.jose4j.jwt.JwtClaims;
2121

2222
import com.ibm.ws.ffdc.annotation.FFDCIgnore;
23+
import com.ibm.ws.kernel.security.thread.ThreadIdentityManager;
2324
import com.ibm.ws.security.jwt.internal.JwtTokenException;
2425

2526
/**
@@ -85,7 +86,7 @@ public static String getSignedJwt(JwtClaims claims, JwtData jwtData) throws JwtT
8586
// payload
8687
// of a JsonWebEncryption object and set the cty (Content Type) header
8788
// to "jwt".
88-
89+
Object token = ThreadIdentityManager.runAsServer();
8990
try {
9091
jwt = jws.getCompactSerialization();
9192
} catch (Exception e) {
@@ -95,6 +96,8 @@ public static String getSignedJwt(JwtClaims claims, JwtData jwtData) throws JwtT
9596
// * Tr.formatMessage(tc,
9697
// * "JWT_CANNOT_GENERATE_JWT", objs),
9798
// */"Can not generate JWT", e);
99+
} finally {
100+
ThreadIdentityManager.reset(token);
98101
}
99102
// if (tc.isDebugEnabled()) {
100103
// Tr.debug(tc, "JWT=", jwt);

‎dev/com.ibm.ws.security.oauth/bnd.bnd‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#*******************************************************************************
2-
# Copyright (c) 2019, 2023 IBM Corporation and others.
2+
# Copyright (c) 2019, 2024 IBM Corporation and others.
33
# All rights reserved. This program and the accompanying materials
44
# are made available under the terms of the Eclipse Public License 2.0
55
# which accompanies this distribution, and is available at
@@ -145,7 +145,8 @@ Include-Resource: \
145145
com.ibm.ws.org.eclipse.equinox.metatype;version=latest,\
146146
com.ibm.ws.security.jwt;version=latest,\
147147
com.ibm.ws.kernel.boot.core;version=latest,\
148-
com.ibm.ws.security.sso.common;version=latest
148+
com.ibm.ws.security.sso.common;version=latest,\
149+
com.ibm.ws.kernel.security.thread;version=latest
149150

150151
-testpath: \
151152
../build.sharedResources/lib/junit/old/junit.jar;version=file, \

‎dev/com.ibm.ws.security.oauth/src/com/ibm/ws/security/oauth20/plugins/jose4j/JwsSigner.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2016 IBM Corporation and others.
2+
* Copyright (c) 2016, 2024 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -22,6 +22,7 @@
2222
import com.ibm.websphere.ras.Tr;
2323
import com.ibm.websphere.ras.TraceComponent;
2424
import com.ibm.ws.ffdc.annotation.FFDCIgnore;
25+
import com.ibm.ws.kernel.security.thread.ThreadIdentityManager;
2526
import com.ibm.ws.security.oauth20.TraceConstants;
2627
import com.ibm.ws.webcontainer.security.openidconnect.OidcServerConfig;
2728

@@ -82,12 +83,15 @@ public static String getSignedJwt(JwtClaims claims, OidcServerConfig oidcServerC
8283
// base64url-encoded parts in the form Header.Payload.Signature
8384
// If you wanted to encrypt it, you can simply set this jwt as the payload
8485
// of a JsonWebEncryption object and set the cty (Content Type) header to "jwt".
86+
Object token = ThreadIdentityManager.runAsServer();
8587
try {
8688
jwt = jws.getCompactSerialization();
8789
} catch (Exception e) {
8890
Object[] objs = new Object[] { oidcServerConfig.getProviderId(), e.getLocalizedMessage() };
8991
Tr.error(tc, "JWT_CANNOT_GENERATE_JWT", objs);
9092
throw new JWTTokenException(Tr.formatMessage(tc, "JWT_CANNOT_GENERATE_JWT", objs), e);
93+
} finally {
94+
ThreadIdentityManager.reset(token);
9195
}
9296
if (tc.isDebugEnabled()) {
9397
Tr.debug(tc, "JWT=", jwt);

‎dev/com.ibm.ws.security.openidconnect.clients.common/bnd.bnd‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#*******************************************************************************
2-
# Copyright (c) 2018, 2023 IBM Corporation and others.
2+
# Copyright (c) 2018, 2024 IBM Corporation and others.
33
# All rights reserved. This program and the accompanying materials
44
# are made available under the terms of the Eclipse Public License 2.0
55
# which accompanies this distribution, and is available at
@@ -84,7 +84,8 @@ Private-Package: \
8484
com.ibm.ws.config;version=latest,\
8585
io.openliberty.security.oidcclientcore.internal;version=latest,\
8686
io.openliberty.security.common.jwt;version=latest,\
87-
com.ibm.ws.security.oauth.2.0;version=latest
87+
com.ibm.ws.security.oauth.2.0;version=latest,\
88+
com.ibm.ws.kernel.security.thread;version=latest
8889

8990
-testpath: \
9091
../build.sharedResources/lib/junit/old/junit.jar;version=file,\

‎dev/com.ibm.ws.security.openidconnect.clients.common/src/com/ibm/ws/security/openidconnect/jose4j/Jose4jValidator.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
import com.ibm.websphere.ras.Tr;
3535
import com.ibm.websphere.ras.TraceComponent;
3636
import com.ibm.ws.ffdc.annotation.FFDCIgnore;
37+
import com.ibm.ws.kernel.security.thread.ThreadIdentityManager;
3738
import com.ibm.ws.security.openidconnect.backchannellogout.BackchannelLogoutConstants;
3839
import com.ibm.ws.security.openidconnect.clients.common.Constants;
3940
import com.ibm.ws.security.openidconnect.clients.common.OidcClientRequest;
@@ -189,7 +190,7 @@ public JwtClaims parseJwtWithValidation(String jwtString,
189190
}
190191

191192
JwtConsumer jwtConsumer = builder.build();
192-
193+
Object token = ThreadIdentityManager.runAsServer();
193194
try {
194195
JwtContext validatedJwtContext = jwtConsumer.process(jwtString);
195196

@@ -226,6 +227,8 @@ public JwtClaims parseJwtWithValidation(String jwtString,
226227
// otherwise throw original Exception
227228
throw e;
228229
}
230+
} finally {
231+
ThreadIdentityManager.reset(token);
229232
}
230233

231234
return jwtClaims;
@@ -327,6 +330,7 @@ public JwtClaims validateJwsSignature(JsonWebSignature signature, String jwtStri
327330
}
328331

329332
JwtConsumer jwtConsumer = builder.build();
333+
Object token = ThreadIdentityManager.runAsServer();
330334
try {
331335
JwtContext validatedJwtContext = jwtConsumer.process(jwtString);
332336
return validatedJwtContext.getJwtClaims();
@@ -344,6 +348,8 @@ public JwtClaims validateJwsSignature(JsonWebSignature signature, String jwtStri
344348
} else {
345349
throw new JWTTokenValidationFailedException(e.getMessage(), e);
346350
}
351+
} finally {
352+
ThreadIdentityManager.reset(token);
347353
}
348354
}
349355

‎dev/com.ibm.ws.security.openidconnect.clients.common/src/com/ibm/ws/security/openidconnect/token/JWT.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2013, 2023 IBM Corporation and others.
2+
* Copyright (c) 2013, 2024 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -34,6 +34,7 @@
3434
import com.ibm.websphere.ras.annotation.Sensitive;
3535
import com.ibm.ws.ffdc.FFDCFilter;
3636
import com.ibm.ws.ffdc.annotation.FFDCIgnore;
37+
import com.ibm.ws.kernel.security.thread.ThreadIdentityManager;
3738
import com.ibm.ws.security.openidconnect.clients.common.Constants;
3839

3940
public class JWT {
@@ -360,8 +361,13 @@ private String serializeAndSign(WSJsonToken token) throws InvalidKeyException, U
360361
}
361362
// todo: did we miss any?
362363
jws.setKey(getKey(alg)); // private key
363-
return jws.getCompactSerialization();
364364

365+
Object threadIdentityToken = ThreadIdentityManager.runAsServer();
366+
try {
367+
return jws.getCompactSerialization();
368+
} finally {
369+
ThreadIdentityManager.reset(threadIdentityToken);
370+
}
365371
}
366372

367373
public String getSignedJWTString() throws SignatureException, InvalidKeyException {

‎dev/com.ibm.ws.security.openidconnect.clients.common/src/com/ibm/ws/security/openidconnect/token/JsonTokenUtil.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2013, 2022 IBM Corporation and others.
2+
* Copyright (c) 2013, 2024 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -43,6 +43,7 @@
4343
import com.google.gson.stream.JsonToken;
4444
import com.ibm.websphere.ras.annotation.Sensitive;
4545
import com.ibm.ws.common.encoder.Base64Coder;
46+
import com.ibm.ws.kernel.security.thread.ThreadIdentityManager;
4647

4748
/**
4849
* Some utility functions for {@link JsonToken}s.
@@ -383,7 +384,12 @@ public static void validateTokenString(String tokenString, String alg, @Sensitiv
383384
}
384385

385386
JwtConsumer secondPassJwtConsumer = secondBuilder.build();
386-
secondPassJwtConsumer.processContext(jwtContext);
387+
Object token = ThreadIdentityManager.runAsServer();
388+
try {
389+
secondPassJwtConsumer.processContext(jwtContext);
390+
} finally {
391+
ThreadIdentityManager.reset(token);
392+
}
387393
}
388394

389395
static Object getJsonPrimitive(JsonPrimitive primitive) {

0 commit comments

Comments
 (0)