Skip to content

Commit 78bcee3

Browse files
rsearlsrsearls
committed
[JBEAP-28701] added use of nonce
1 parent f607fb7 commit 78bcee3

File tree

13 files changed

+197
-30
lines changed

13 files changed

+197
-30
lines changed

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/AuthenticationError.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@ public enum Reason {
3636
INVALID_TOKEN,
3737
STALE_TOKEN,
3838
NO_AUTHORIZATION_HEADER,
39-
NO_QUERY_PARAMETER_ACCESS_TOKEN
39+
NO_QUERY_PARAMETER_ACCESS_TOKEN,
40+
INVALID_NONCE
4041
}
4142

4243
private Reason reason;

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/ElytronMessages.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,5 +278,14 @@ interface ElytronMessages extends BasicLogger {
278278

279279
@Message(id = 23070, value = "Authentication request format must be one of the following: oauth2, request, request_uri.")
280280
RuntimeException invalidAuthenticationRequestFormat();
281+
282+
@Message(id = 23071, value = "Invalid ID token nonce: %s")
283+
String invalidNonceValue(String name);
284+
285+
@Message(id = 23072, value = "No such algorithm: '%s'")
286+
IllegalArgumentException noSuchAlgorithm(String algorithm);
287+
288+
@Message(id = 23073, value = "Nonce cookie does not exist")
289+
String nonceCookieDoesNotExist();
281290
}
282291

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/IDToken.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ public class IDToken extends JsonWebToken {
5353
public static final String CLAIMS_LOCALES = "claims_locales";
5454
public static final String ACR = "acr";
5555
public static final String S_HASH = "s_hash";
56+
public static final String NONCE = "nonce";
5657

5758
/**
5859
* Construct a new instance.
@@ -228,4 +229,7 @@ public String getAcr() {
228229
return getClaimValueAsString(ACR);
229230
}
230231

232+
public String getNonce() {
233+
return getClaimValueAsString(NONCE);
234+
}
231235
}

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/Oidc.java‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,15 @@
1919
package org.wildfly.security.http.oidc;
2020

2121
import static org.wildfly.security.http.oidc.ElytronMessages.log;
22+
import static org.wildfly.security.jose.jwk.JWKUtil.BASE64_URL;
2223

2324
import java.io.IOException;
2425
import java.io.InputStream;
2526
import java.net.InetAddress;
2627
import java.net.UnknownHostException;
28+
import java.nio.charset.StandardCharsets;
29+
import java.security.MessageDigest;
30+
import java.security.NoSuchAlgorithmException;
2731
import java.util.Map;
2832
import java.util.StringTokenizer;
2933
import java.util.UUID;
@@ -34,6 +38,7 @@
3438
import org.apache.http.HttpResponse;
3539
import org.apache.http.client.methods.HttpRequestBase;
3640
import org.jose4j.jws.AlgorithmIdentifiers;
41+
import org.wildfly.common.iteration.ByteIterator;
3742
import org.wildfly.security.jose.util.JsonSerialization;
3843

3944
/**
@@ -111,6 +116,7 @@ public class Oidc {
111116
public static final String REDIRECT_URI = "redirect_uri";
112117
public static final String REFRESH_TOKEN = "refresh_token";
113118
public static final String RESPONSE_TYPE = "response_type";
119+
public static final String SESSION_RANDOM_VALUE="session_random_value";
114120
public static final String SESSION_STATE = "session_state";
115121
public static final String SOAP_ACTION = "SOAPAction";
116122
public static final String SSL_REQUIRED = "ssl-required";
@@ -119,6 +125,7 @@ public class Oidc {
119125
public static final int INVALID_ISSUED_FOR_CLAIM = -1;
120126
public static final int INVALID_AT_HASH_CLAIM = -2;
121127
public static final int INVALID_TYPE_CLAIM = -3;
128+
public static final int INVALID_SESSION_RANDOM_VALUE = -4;
122129
static final String OIDC_CLIENT_CONFIG_RESOLVER = "oidc.config.resolver";
123130
static final String OIDC_CONFIG_FILE_LOCATION = "oidc.config.file";
124131
static final String OIDC_JSON_FILE = "/WEB-INF/oidc.json";
@@ -445,4 +452,14 @@ protected static boolean checkCachedAccountMatchesRequest(OidcAccount account, O
445452
return true;
446453
}
447454

455+
public static String getCryptographicValue(final String src) {
456+
try {
457+
MessageDigest md = MessageDigest.getInstance(SHA256);
458+
md.update(src.getBytes(StandardCharsets.UTF_8));
459+
return ByteIterator.ofBytes(md.digest())
460+
.base64Encode(BASE64_URL, false).drainToString();
461+
} catch (NoSuchAlgorithmException e) {
462+
throw log.noSuchAlgorithm(e.getMessage());
463+
}
464+
}
448465
}

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/OidcCookieTokenStore.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ public static OidcPrincipal<RefreshableOidcSecurityContext> getPrincipalFromCook
227227
idToken = new IDToken(new JwtConsumerBuilder().setSkipSignatureVerification().setSkipAllValidators().build().processToClaims(idTokenString));
228228
}
229229
log.debug("Token obtained from cookie");
230-
RefreshableOidcSecurityContext secContext = new RefreshableOidcSecurityContext(deployment, tokenStore, accessTokenString, accessToken, idTokenString, idToken, refreshTokenString);
230+
RefreshableOidcSecurityContext secContext = new RefreshableOidcSecurityContext(deployment, facade, tokenStore, accessTokenString, accessToken, idTokenString, idToken, refreshTokenString);
231231
return new OidcPrincipal<>(idToken.getPrincipalName(deployment), secContext);
232232
} catch (InvalidJwtException e) {
233233
log.failedToParseTokenFromCookie(e);

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/OidcRequestAuthenticator.java‎

Lines changed: 32 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import static org.jose4j.jws.AlgorithmIdentifiers.HMAC_SHA512;
2424
import static org.jose4j.jws.AlgorithmIdentifiers.NONE;
2525
import static org.wildfly.security.http.oidc.ElytronMessages.log;
26+
import static org.wildfly.security.http.oidc.IDToken.NONCE;
2627
import static org.wildfly.security.http.oidc.Oidc.ALLOW_QUERY_PARAMS_PROPERTY_NAME;
2728
import static org.wildfly.security.http.oidc.Oidc.CLIENT_ID;
2829
import static org.wildfly.security.http.oidc.Oidc.CODE;
@@ -39,6 +40,7 @@
3940
import static org.wildfly.security.http.oidc.Oidc.REQUEST;
4041
import static org.wildfly.security.http.oidc.Oidc.REQUEST_URI;
4142
import static org.wildfly.security.http.oidc.Oidc.SCOPE;
43+
import static org.wildfly.security.http.oidc.Oidc.SESSION_RANDOM_VALUE;
4244
import static org.wildfly.security.http.oidc.Oidc.SESSION_STATE;
4345
import static org.wildfly.security.http.oidc.Oidc.STATE;
4446
import static org.wildfly.security.http.oidc.Oidc.UI_LOCALES;
@@ -59,6 +61,7 @@
5961
import java.security.Key;
6062
import java.security.KeyPair;
6163
import java.security.PublicKey;
64+
import java.security.SecureRandom;
6265
import java.util.ArrayList;
6366
import java.util.Arrays;
6467
import java.util.HashSet;
@@ -76,6 +79,7 @@
7679
import org.jose4j.jwt.JwtClaims;
7780
import org.jose4j.keys.HmacKey;
7881
import org.jose4j.lang.JoseException;
82+
import org.wildfly.common.iteration.ByteIterator;
7983
import org.wildfly.security.http.HttpConstants;
8084

8185
/**
@@ -96,6 +100,8 @@ public class OidcRequestAuthenticator {
96100
protected String refreshToken;
97101
protected String strippedOauthParametersRequestUri;
98102

103+
private int NONCE_SIZE = 36;
104+
99105
static final boolean ALLOW_QUERY_PARAMS_PROPERTY;
100106

101107
static {
@@ -181,7 +187,7 @@ protected String getCode() {
181187
return getQueryParamValue(facade, CODE);
182188
}
183189

184-
protected String getRedirectUri(String state) {
190+
protected String getRedirectUri(String state, String sessionRandomValueHash) {
185191
String url = getRequestUrl();
186192
log.debugf("callback uri: %s", url);
187193

@@ -222,14 +228,15 @@ protected String getRedirectUri(String state) {
222228
String redirectUri = rewrittenRedirectUri(url);
223229
URIBuilder redirectUriBuilder = new URIBuilder(deployment.getAuthUrl());
224230
redirectUriBuilder.addParameter(RESPONSE_TYPE, CODE)
225-
.addParameter(CLIENT_ID, deployment.getResourceName());
231+
.addParameter(CLIENT_ID, deployment.getResourceName())
232+
.addParameter(NONCE, sessionRandomValueHash);
226233

227234
switch (deployment.getAuthenticationRequestFormat()) {
228235
case REQUEST:
229236
if (deployment.getRequestParameterSupported()) {
230237
// add request objects into request parameter
231238
try {
232-
createRequestWithRequestParameter(REQUEST, redirectUriBuilder, redirectUri, state, forwardedQueryParams);
239+
createRequestWithRequestParameter(REQUEST, redirectUriBuilder, redirectUri, state, forwardedQueryParams, sessionRandomValueHash);
233240
} catch (IOException | JoseException e) {
234241
throw log.unableToCreateRequestWithRequestParameter(e);
235242
}
@@ -242,7 +249,7 @@ protected String getRedirectUri(String state) {
242249
case REQUEST_URI:
243250
if (deployment.getRequestUriParameterSupported()) {
244251
try {
245-
createRequestWithRequestParameter(REQUEST_URI, redirectUriBuilder, redirectUri, state, forwardedQueryParams);
252+
createRequestWithRequestParameter(REQUEST_URI, redirectUriBuilder, redirectUri, state, forwardedQueryParams, sessionRandomValueHash);
246253
} catch (IOException | JoseException e) {
247254
throw log.unableToCreateRequestUriWithRequestParameter(e);
248255
}
@@ -269,8 +276,8 @@ protected URIBuilder createOAuthRequest(URIBuilder redirectUriBuilder, String re
269276
return redirectUriBuilder;
270277
}
271278

272-
protected URIBuilder createRequestWithRequestParameter(String requestFormat, URIBuilder redirectUriBuilder, String redirectUri, String state, List<NameValuePair> forwardedQueryParams) throws JoseException, IOException {
273-
String request = convertToRequestParameter(redirectUriBuilder, redirectUri, state, forwardedQueryParams);
279+
protected URIBuilder createRequestWithRequestParameter(String requestFormat, URIBuilder redirectUriBuilder, String redirectUri, String state, List<NameValuePair> forwardedQueryParams, String sessionRandomValueHash) throws JoseException, IOException {
280+
String request = convertToRequestParameter(redirectUriBuilder, redirectUri, state, forwardedQueryParams, sessionRandomValueHash);
274281

275282
switch (requestFormat) {
276283
case REQUEST:
@@ -296,7 +303,8 @@ protected String getStateCode() {
296303

297304
protected AuthChallenge loginRedirect() {
298305
final String state = getStateCode();
299-
final String redirect = getRedirectUri(state);
306+
final String sessionRandomValue = generateSessionRandomValue();
307+
final String redirect = getRedirectUri(state, Oidc.getCryptographicValue(sessionRandomValue));
300308
if (redirect == null) {
301309
return challenge(HttpStatus.SC_FORBIDDEN, AuthenticationError.Reason.NO_REDIRECT_URI, null);
302310
}
@@ -314,6 +322,8 @@ public boolean challenge(OidcHttpFacade exchange) {
314322
exchange.getResponse().setStatus(HttpStatus.SC_MOVED_TEMPORARILY);
315323
exchange.getResponse().setCookie(deployment.getStateCookieName(), state, "/", null, -1, deployment.getSSLRequired().isRequired(facade.getRequest().getRemoteAddr()), true);
316324
exchange.getResponse().setHeader(HttpConstants.LOCATION, redirect);
325+
exchange.getResponse().setCookie(SESSION_RANDOM_VALUE, sessionRandomValue, "/", null, -1, deployment.getSSLRequired().isRequired(facade.getRequest().getRemoteAddr()), true);
326+
317327
return true;
318328
}
319329
};
@@ -336,6 +346,7 @@ protected AuthChallenge checkStateCookie() {
336346
log.warn("state parameter was null");
337347
return challenge(HttpStatus.SC_BAD_REQUEST, AuthenticationError.Reason.INVALID_STATE_COOKIE, null);
338348
}
349+
339350
if (!state.equals(stateCookieValue)) {
340351
log.warn("state parameter invalid");
341352
log.warn("cookie: " + stateCookieValue);
@@ -441,9 +452,11 @@ protected AuthChallenge resolveCode(String code) {
441452

442453
try {
443454
TokenValidator tokenValidator = TokenValidator.builder(deployment).build();
444-
TokenValidator.VerifiedTokens verifiedTokens = tokenValidator.parseAndVerifyToken(idTokenString, tokenString);
455+
456+
TokenValidator.VerifiedTokens verifiedTokens = tokenValidator.parseAndVerifyToken(idTokenString, tokenString, facade);
445457
idToken = verifiedTokens.getIdToken();
446458
token = verifiedTokens.getAccessToken();
459+
447460
log.debug("Token Verification succeeded!");
448461
} catch (OidcException e) {
449462
log.failedVerificationOfToken(e.getMessage());
@@ -456,6 +469,7 @@ protected AuthChallenge resolveCode(String code) {
456469
log.error("Stale token");
457470
return challenge(HttpStatus.SC_FORBIDDEN, AuthenticationError.Reason.STALE_TOKEN, null);
458471
}
472+
459473
log.debug("successfully authenticated");
460474
return null;
461475
}
@@ -535,7 +549,7 @@ private void addScopes(String scopes, Set<String> allScopes) {
535549
}
536550
}
537551

538-
private String convertToRequestParameter(URIBuilder redirectUriBuilder, String redirectUri, String state, List<NameValuePair> forwardedQueryParams) throws JoseException, IOException {
552+
private String convertToRequestParameter(URIBuilder redirectUriBuilder, String redirectUri, String state, List<NameValuePair> forwardedQueryParams, String sessionRandomValueHash) throws JoseException, IOException {
539553
redirectUriBuilder.addParameter(SCOPE, OIDC_SCOPE);
540554

541555
JwtClaims jwtClaims = new JwtClaims();
@@ -545,10 +559,12 @@ private String convertToRequestParameter(URIBuilder redirectUriBuilder, String r
545559
for ( NameValuePair parameter: forwardedQueryParams) {
546560
jwtClaims.setClaim(parameter.getName(), parameter.getValue());
547561
}
562+
548563
jwtClaims.setClaim(STATE, state);
549564
jwtClaims.setClaim(REDIRECT_URI, redirectUri);
550565
jwtClaims.setClaim(RESPONSE_TYPE, CODE);
551566
jwtClaims.setClaim(CLIENT_ID, deployment.getResourceName());
567+
jwtClaims.setClaim(NONCE, sessionRandomValueHash);
552568

553569
// sign JWT first before encrypting
554570
JsonWebSignature signedRequest = signRequest(jwtClaims, deployment);
@@ -622,4 +638,11 @@ private JsonWebEncryption encryptRequest(JsonWebSignature signedRequest) throws
622638
return jsonEncryption;
623639
}
624640
}
641+
642+
private String generateSessionRandomValue() {
643+
SecureRandom random = new SecureRandom();
644+
byte[] nonceData = new byte[NONCE_SIZE];
645+
random.nextBytes(nonceData);
646+
return ByteIterator.ofBytes(nonceData).base64Encode().drainToString();
647+
}
625648
}

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/RefreshableOidcSecurityContext.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,16 +34,18 @@ public class RefreshableOidcSecurityContext extends OidcSecurityContext {
3434
protected transient OidcClientConfiguration clientConfiguration;
3535
protected transient OidcTokenStore tokenStore;
3636
protected String refreshToken;
37+
protected transient OidcHttpFacade facade;
3738

3839
public RefreshableOidcSecurityContext() {
3940
}
4041

41-
public RefreshableOidcSecurityContext(OidcClientConfiguration clientConfiguration, OidcTokenStore tokenStore, String tokenString,
42+
public RefreshableOidcSecurityContext(OidcClientConfiguration clientConfiguration, OidcHttpFacade facade, OidcTokenStore tokenStore, String tokenString,
4243
AccessToken token, String idTokenString, IDToken idToken, String refreshToken) {
4344
super(tokenString, token, idTokenString, idToken);
4445
this.clientConfiguration = clientConfiguration;
4546
this.tokenStore = tokenStore;
4647
this.refreshToken = refreshToken;
48+
this.facade = facade;
4749
}
4850

4951
@Override
@@ -149,7 +151,7 @@ public boolean refreshToken(boolean checkActive) {
149151
IDToken idToken;
150152
try {
151153
TokenValidator tokenValidator = TokenValidator.builder(clientConfiguration).build();
152-
TokenValidator.VerifiedTokens verifiedTokens = tokenValidator.parseAndVerifyToken(idTokenString, accessTokenString);
154+
TokenValidator.VerifiedTokens verifiedTokens = tokenValidator.parseAndVerifyToken(idTokenString, accessTokenString, facade);
153155
idToken = verifiedTokens.getIdToken();
154156
accessToken = verifiedTokens.getAccessToken();
155157
log.debug("Token Verification succeeded!");

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/RequestAuthenticator.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -200,14 +200,14 @@ protected boolean verifySSL() {
200200
}
201201

202202
protected void completeAuthentication(OidcRequestAuthenticator oidc) {
203-
RefreshableOidcSecurityContext session = new RefreshableOidcSecurityContext(deployment, facade.getTokenStore(), oidc.getTokenString(), oidc.getToken(), oidc.getIDTokenString(), oidc.getIDToken(), oidc.getRefreshToken());
203+
RefreshableOidcSecurityContext session = new RefreshableOidcSecurityContext(deployment, facade, facade.getTokenStore(), oidc.getTokenString(), oidc.getToken(), oidc.getIDTokenString(), oidc.getIDToken(), oidc.getRefreshToken());
204204
final OidcPrincipal<RefreshableOidcSecurityContext> principal = new OidcPrincipal<>(oidc.getIDToken().getPrincipalName(deployment), session);
205205
completeOidcAuthentication(principal);
206206
log.debugv("User ''{0}'' invoking ''{1}'' on client ''{2}''", principal.getName(), facade.getRequest().getURI(), deployment.getResourceName());
207207
}
208208

209209
protected void completeAuthentication(BearerTokenRequestAuthenticator bearer) {
210-
RefreshableOidcSecurityContext session = new RefreshableOidcSecurityContext(deployment, null, bearer.getTokenString(), bearer.getToken(), null, null, null);
210+
RefreshableOidcSecurityContext session = new RefreshableOidcSecurityContext(deployment, facade, null, bearer.getTokenString(), bearer.getToken(), null, null, null);
211211
final OidcPrincipal<RefreshableOidcSecurityContext> principal = new OidcPrincipal<>(bearer.getToken().getPrincipalName(deployment), session);
212212
completeBearerAuthentication(principal);
213213
log.debugv("User ''{0}'' invoking ''{1}'' on client ''{2}''", principal.getName(), facade.getRequest().getURI(), deployment.getResourceName());

0 commit comments

Comments
 (0)