Skip to content

Commit c13e1c1

Browse files
rsearlsrsearls
committed
[JBEAP-28701] added use of nonce
1 parent f607fb7 commit c13e1c1

File tree

8 files changed

+190
-16
lines changed

8 files changed

+190
-16
lines changed

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/AuthenticationError.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@ public enum Reason {
3636
INVALID_TOKEN,
3737
STALE_TOKEN,
3838
NO_AUTHORIZATION_HEADER,
39-
NO_QUERY_PARAMETER_ACCESS_TOKEN
39+
NO_QUERY_PARAMETER_ACCESS_TOKEN,
40+
INVALID_NONCE
4041
}
4142

4243
private Reason reason;

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/ElytronMessages.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,5 +278,11 @@ interface ElytronMessages extends BasicLogger {
278278

279279
@Message(id = 23070, value = "Authentication request format must be one of the following: oauth2, request, request_uri.")
280280
RuntimeException invalidAuthenticationRequestFormat();
281+
282+
@Message(id = 23071, value = "Invalid %s")
283+
String invalidSessionRandomValue(String name);
284+
285+
@Message(id = 23072, value = "No Such algorithm: '%s'")
286+
IllegalArgumentException noSuchAlgorithm(String algorithm);
281287
}
282288

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/IDToken.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ public class IDToken extends JsonWebToken {
5353
public static final String CLAIMS_LOCALES = "claims_locales";
5454
public static final String ACR = "acr";
5555
public static final String S_HASH = "s_hash";
56+
public static final String NONCE = "nonce";
5657

5758
/**
5859
* Construct a new instance.
@@ -228,4 +229,7 @@ public String getAcr() {
228229
return getClaimValueAsString(ACR);
229230
}
230231

232+
public String getNonce() {
233+
return getClaimValueAsString(NONCE);
234+
}
231235
}

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/Oidc.java‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,15 @@
1919
package org.wildfly.security.http.oidc;
2020

2121
import static org.wildfly.security.http.oidc.ElytronMessages.log;
22+
import static org.wildfly.security.jose.jwk.JWKUtil.BASE64_URL;
2223

2324
import java.io.IOException;
2425
import java.io.InputStream;
2526
import java.net.InetAddress;
2627
import java.net.UnknownHostException;
28+
import java.nio.charset.StandardCharsets;
29+
import java.security.MessageDigest;
30+
import java.security.NoSuchAlgorithmException;
2731
import java.util.Map;
2832
import java.util.StringTokenizer;
2933
import java.util.UUID;
@@ -34,6 +38,7 @@
3438
import org.apache.http.HttpResponse;
3539
import org.apache.http.client.methods.HttpRequestBase;
3640
import org.jose4j.jws.AlgorithmIdentifiers;
41+
import org.wildfly.common.iteration.ByteIterator;
3742
import org.wildfly.security.jose.util.JsonSerialization;
3843

3944
/**
@@ -111,6 +116,7 @@ public class Oidc {
111116
public static final String REDIRECT_URI = "redirect_uri";
112117
public static final String REFRESH_TOKEN = "refresh_token";
113118
public static final String RESPONSE_TYPE = "response_type";
119+
public static final String SESSION_RANDOM_VALUE="session_random_value";
114120
public static final String SESSION_STATE = "session_state";
115121
public static final String SOAP_ACTION = "SOAPAction";
116122
public static final String SSL_REQUIRED = "ssl-required";
@@ -119,6 +125,7 @@ public class Oidc {
119125
public static final int INVALID_ISSUED_FOR_CLAIM = -1;
120126
public static final int INVALID_AT_HASH_CLAIM = -2;
121127
public static final int INVALID_TYPE_CLAIM = -3;
128+
public static final int INVALID_SESSION_RANDOM_VALUE = -4;
122129
static final String OIDC_CLIENT_CONFIG_RESOLVER = "oidc.config.resolver";
123130
static final String OIDC_CONFIG_FILE_LOCATION = "oidc.config.file";
124131
static final String OIDC_JSON_FILE = "/WEB-INF/oidc.json";
@@ -445,4 +452,14 @@ protected static boolean checkCachedAccountMatchesRequest(OidcAccount account, O
445452
return true;
446453
}
447454

455+
public static String getCryptographicValue(final String src) {
456+
try {
457+
MessageDigest md = MessageDigest.getInstance(SHA256);
458+
md.update(src.getBytes(StandardCharsets.UTF_8));
459+
return ByteIterator.ofBytes(md.digest())
460+
.base64Encode(BASE64_URL, false).drainToString();
461+
} catch (NoSuchAlgorithmException e) {
462+
throw log.noSuchAlgorithm(e.getMessage());
463+
}
464+
}
448465
}

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/OidcRequestAuthenticator.java‎

Lines changed: 41 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import static org.jose4j.jws.AlgorithmIdentifiers.HMAC_SHA512;
2424
import static org.jose4j.jws.AlgorithmIdentifiers.NONE;
2525
import static org.wildfly.security.http.oidc.ElytronMessages.log;
26+
import static org.wildfly.security.http.oidc.IDToken.NONCE;
2627
import static org.wildfly.security.http.oidc.Oidc.ALLOW_QUERY_PARAMS_PROPERTY_NAME;
2728
import static org.wildfly.security.http.oidc.Oidc.CLIENT_ID;
2829
import static org.wildfly.security.http.oidc.Oidc.CODE;
@@ -39,6 +40,7 @@
3940
import static org.wildfly.security.http.oidc.Oidc.REQUEST;
4041
import static org.wildfly.security.http.oidc.Oidc.REQUEST_URI;
4142
import static org.wildfly.security.http.oidc.Oidc.SCOPE;
43+
import static org.wildfly.security.http.oidc.Oidc.SESSION_RANDOM_VALUE;
4244
import static org.wildfly.security.http.oidc.Oidc.SESSION_STATE;
4345
import static org.wildfly.security.http.oidc.Oidc.STATE;
4446
import static org.wildfly.security.http.oidc.Oidc.UI_LOCALES;
@@ -59,6 +61,7 @@
5961
import java.security.Key;
6062
import java.security.KeyPair;
6163
import java.security.PublicKey;
64+
import java.security.SecureRandom;
6265
import java.util.ArrayList;
6366
import java.util.Arrays;
6467
import java.util.HashSet;
@@ -76,6 +79,7 @@
7679
import org.jose4j.jwt.JwtClaims;
7780
import org.jose4j.keys.HmacKey;
7881
import org.jose4j.lang.JoseException;
82+
import org.wildfly.common.iteration.ByteIterator;
7983
import org.wildfly.security.http.HttpConstants;
8084

8185
/**
@@ -96,6 +100,8 @@ public class OidcRequestAuthenticator {
96100
protected String refreshToken;
97101
protected String strippedOauthParametersRequestUri;
98102

103+
private int NONCE_SIZE = 36;
104+
99105
static final boolean ALLOW_QUERY_PARAMS_PROPERTY;
100106

101107
static {
@@ -181,7 +187,7 @@ protected String getCode() {
181187
return getQueryParamValue(facade, CODE);
182188
}
183189

184-
protected String getRedirectUri(String state) {
190+
protected String getRedirectUri(String state, String sessionRandomValue) {
185191
String url = getRequestUrl();
186192
log.debugf("callback uri: %s", url);
187193

@@ -221,15 +227,17 @@ protected String getRedirectUri(String state) {
221227

222228
String redirectUri = rewrittenRedirectUri(url);
223229
URIBuilder redirectUriBuilder = new URIBuilder(deployment.getAuthUrl());
230+
String cryptoValue = Oidc.getCryptographicValue(sessionRandomValue);
224231
redirectUriBuilder.addParameter(RESPONSE_TYPE, CODE)
225-
.addParameter(CLIENT_ID, deployment.getResourceName());
232+
.addParameter(CLIENT_ID, deployment.getResourceName())
233+
.addParameter(NONCE, cryptoValue);
226234

227235
switch (deployment.getAuthenticationRequestFormat()) {
228236
case REQUEST:
229237
if (deployment.getRequestParameterSupported()) {
230238
// add request objects into request parameter
231239
try {
232-
createRequestWithRequestParameter(REQUEST, redirectUriBuilder, redirectUri, state, forwardedQueryParams);
240+
createRequestWithRequestParameter(REQUEST, redirectUriBuilder, redirectUri, state, forwardedQueryParams, sessionRandomValue);
233241
} catch (IOException | JoseException e) {
234242
throw log.unableToCreateRequestWithRequestParameter(e);
235243
}
@@ -242,7 +250,7 @@ protected String getRedirectUri(String state) {
242250
case REQUEST_URI:
243251
if (deployment.getRequestUriParameterSupported()) {
244252
try {
245-
createRequestWithRequestParameter(REQUEST_URI, redirectUriBuilder, redirectUri, state, forwardedQueryParams);
253+
createRequestWithRequestParameter(REQUEST_URI, redirectUriBuilder, redirectUri, state, forwardedQueryParams, sessionRandomValue);
246254
} catch (IOException | JoseException e) {
247255
throw log.unableToCreateRequestUriWithRequestParameter(e);
248256
}
@@ -269,8 +277,8 @@ protected URIBuilder createOAuthRequest(URIBuilder redirectUriBuilder, String re
269277
return redirectUriBuilder;
270278
}
271279

272-
protected URIBuilder createRequestWithRequestParameter(String requestFormat, URIBuilder redirectUriBuilder, String redirectUri, String state, List<NameValuePair> forwardedQueryParams) throws JoseException, IOException {
273-
String request = convertToRequestParameter(redirectUriBuilder, redirectUri, state, forwardedQueryParams);
280+
protected URIBuilder createRequestWithRequestParameter(String requestFormat, URIBuilder redirectUriBuilder, String redirectUri, String state, List<NameValuePair> forwardedQueryParams, String sessionRandomValue) throws JoseException, IOException {
281+
String request = convertToRequestParameter(redirectUriBuilder, redirectUri, state, forwardedQueryParams, sessionRandomValue);
274282

275283
switch (requestFormat) {
276284
case REQUEST:
@@ -296,7 +304,8 @@ protected String getStateCode() {
296304

297305
protected AuthChallenge loginRedirect() {
298306
final String state = getStateCode();
299-
final String redirect = getRedirectUri(state);
307+
final String sessionRandomValue = generateSessionRandomValue();
308+
final String redirect = getRedirectUri(state, sessionRandomValue);
300309
if (redirect == null) {
301310
return challenge(HttpStatus.SC_FORBIDDEN, AuthenticationError.Reason.NO_REDIRECT_URI, null);
302311
}
@@ -314,6 +323,8 @@ public boolean challenge(OidcHttpFacade exchange) {
314323
exchange.getResponse().setStatus(HttpStatus.SC_MOVED_TEMPORARILY);
315324
exchange.getResponse().setCookie(deployment.getStateCookieName(), state, "/", null, -1, deployment.getSSLRequired().isRequired(facade.getRequest().getRemoteAddr()), true);
316325
exchange.getResponse().setHeader(HttpConstants.LOCATION, redirect);
326+
exchange.getResponse().setCookie(SESSION_RANDOM_VALUE, sessionRandomValue, "/", null, -1, deployment.getSSLRequired().isRequired(facade.getRequest().getRemoteAddr()), true);
327+
317328
return true;
318329
}
319330
};
@@ -329,13 +340,20 @@ protected AuthChallenge checkStateCookie() {
329340
// reset the cookie
330341
log.debug("** reseting application state cookie");
331342
facade.getResponse().resetCookie(deployment.getStateCookieName(), stateCookie.getPath());
332-
String stateCookieValue = getCookieValue(deployment.getStateCookieName());
343+
String cookiesStr = getCookieValue(deployment.getStateCookieName());
333344

334345
String state = getQueryParamValue(facade, STATE);
335346
if (state == null) {
336347
log.warn("state parameter was null");
337348
return challenge(HttpStatus.SC_BAD_REQUEST, AuthenticationError.Reason.INVALID_STATE_COOKIE, null);
338349
}
350+
351+
String stateCookieValue = cookiesStr;
352+
if (cookiesStr != null) {
353+
String[] cookieArr = cookiesStr.split(";");
354+
stateCookieValue = cookieArr[0];
355+
}
356+
339357
if (!state.equals(stateCookieValue)) {
340358
log.warn("state parameter invalid");
341359
log.warn("cookie: " + stateCookieValue);
@@ -441,9 +459,11 @@ protected AuthChallenge resolveCode(String code) {
441459

442460
try {
443461
TokenValidator tokenValidator = TokenValidator.builder(deployment).build();
444-
TokenValidator.VerifiedTokens verifiedTokens = tokenValidator.parseAndVerifyToken(idTokenString, tokenString);
462+
String stateCookieValue = getCookieValue(deployment.getStateCookieName());
463+
TokenValidator.VerifiedTokens verifiedTokens = tokenValidator.parseAndVerifyToken(idTokenString, tokenString, stateCookieValue);
445464
idToken = verifiedTokens.getIdToken();
446465
token = verifiedTokens.getAccessToken();
466+
447467
log.debug("Token Verification succeeded!");
448468
} catch (OidcException e) {
449469
log.failedVerificationOfToken(e.getMessage());
@@ -456,6 +476,7 @@ protected AuthChallenge resolveCode(String code) {
456476
log.error("Stale token");
457477
return challenge(HttpStatus.SC_FORBIDDEN, AuthenticationError.Reason.STALE_TOKEN, null);
458478
}
479+
459480
log.debug("successfully authenticated");
460481
return null;
461482
}
@@ -535,7 +556,7 @@ private void addScopes(String scopes, Set<String> allScopes) {
535556
}
536557
}
537558

538-
private String convertToRequestParameter(URIBuilder redirectUriBuilder, String redirectUri, String state, List<NameValuePair> forwardedQueryParams) throws JoseException, IOException {
559+
private String convertToRequestParameter(URIBuilder redirectUriBuilder, String redirectUri, String state, List<NameValuePair> forwardedQueryParams, String sessionRandomValue) throws JoseException, IOException {
539560
redirectUriBuilder.addParameter(SCOPE, OIDC_SCOPE);
540561

541562
JwtClaims jwtClaims = new JwtClaims();
@@ -545,10 +566,13 @@ private String convertToRequestParameter(URIBuilder redirectUriBuilder, String r
545566
for ( NameValuePair parameter: forwardedQueryParams) {
546567
jwtClaims.setClaim(parameter.getName(), parameter.getValue());
547568
}
569+
548570
jwtClaims.setClaim(STATE, state);
549571
jwtClaims.setClaim(REDIRECT_URI, redirectUri);
550572
jwtClaims.setClaim(RESPONSE_TYPE, CODE);
551573
jwtClaims.setClaim(CLIENT_ID, deployment.getResourceName());
574+
String cryptoValue = Oidc.getCryptographicValue(sessionRandomValue);
575+
jwtClaims.setClaim(NONCE, String.valueOf(cryptoValue));
552576

553577
// sign JWT first before encrypting
554578
JsonWebSignature signedRequest = signRequest(jwtClaims, deployment);
@@ -622,4 +646,11 @@ private JsonWebEncryption encryptRequest(JsonWebSignature signedRequest) throws
622646
return jsonEncryption;
623647
}
624648
}
649+
650+
private String generateSessionRandomValue() {
651+
SecureRandom random = new SecureRandom();
652+
byte[] nonceData = new byte[NONCE_SIZE];
653+
random.nextBytes(nonceData);
654+
return ByteIterator.ofBytes(nonceData).base64Encode().drainToString();
655+
}
625656
}

‎http/oidc/src/main/java/org/wildfly/security/http/oidc/TokenValidator.java‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,9 @@
2323
import static org.wildfly.security.http.oidc.Oidc.DISABLE_TYP_CLAIM_VALIDATION_PROPERTY_NAME;
2424
import static org.wildfly.security.http.oidc.Oidc.INVALID_AT_HASH_CLAIM;
2525
import static org.wildfly.security.http.oidc.Oidc.INVALID_ISSUED_FOR_CLAIM;
26+
import static org.wildfly.security.http.oidc.Oidc.INVALID_SESSION_RANDOM_VALUE;
2627
import static org.wildfly.security.http.oidc.Oidc.INVALID_TYPE_CLAIM;
28+
import static org.wildfly.security.http.oidc.Oidc.SESSION_RANDOM_VALUE;
2729
import static org.wildfly.security.http.oidc.Oidc.getJavaAlgorithmForHash;
2830
import static org.wildfly.security.jose.jwk.JWKUtil.BASE64_URL;
2931

@@ -83,11 +85,18 @@ private TokenValidator(Builder builder) {
8385
* @throws OidcException if the ID token is invalid
8486
*/
8587
public VerifiedTokens parseAndVerifyToken(final String idToken, final String accessToken) throws OidcException {
88+
return parseAndVerifyToken(idToken, accessToken, null);
89+
}
90+
91+
public VerifiedTokens parseAndVerifyToken(final String idToken, final String accessToken, final String cookiesStr) throws OidcException {
8692
try {
8793
JwtContext idJwtContext = setVerificationKey(idToken, jwtConsumerBuilder);
8894
jwtConsumerBuilder.setExpectedAudience(clientConfiguration.getResourceName());
8995
jwtConsumerBuilder.registerValidator(new AzpValidator(clientConfiguration.getResourceName()));
9096
jwtConsumerBuilder.registerValidator(new AtHashValidator(accessToken, clientConfiguration.getTokenSignatureAlgorithm()));
97+
if (cookiesStr != null) {
98+
jwtConsumerBuilder.registerValidator(new NonceValidator(cookiesStr));
99+
}
91100
// second pass to validate
92101
jwtConsumerBuilder.build().processContext(idJwtContext);
93102
JwtClaims idJwtClaims = idJwtContext.getJwtClaims();
@@ -288,6 +297,38 @@ private static String getAccessTokenHash(String accessTokenString, String jwsAlg
288297

289298
}
290299

300+
301+
private static class NonceValidator implements ErrorCodeValidator {
302+
private final String stateCookieValue;
303+
304+
public NonceValidator(final String stateCookieValue) {
305+
this.stateCookieValue = stateCookieValue;
306+
}
307+
308+
public ErrorCodeValidator.Error validate(JwtContext jwtContext) throws MalformedClaimException {
309+
JwtClaims idJwtClaims = jwtContext.getJwtClaims();
310+
IDToken idToken = new IDToken(idJwtClaims);
311+
312+
String[] cookieArr = stateCookieValue.split(";");
313+
String sessionIdValue = "";
314+
for(int i=0; i < cookieArr.length; i++) {
315+
String cookie = cookieArr[i].trim();
316+
if (cookie.startsWith(SESSION_RANDOM_VALUE+"=")) {
317+
sessionIdValue = cookie.substring((SESSION_RANDOM_VALUE+"=").length());
318+
sessionIdValue = Oidc.getCryptographicValue(sessionIdValue);
319+
break;
320+
}
321+
}
322+
String nonceValue = idToken.getNonce();
323+
if (nonceValue == null || !MessageDigest.isEqual(nonceValue.getBytes(),
324+
sessionIdValue.getBytes())) {
325+
return new ErrorCodeValidator.Error(INVALID_SESSION_RANDOM_VALUE,
326+
log.invalidSessionRandomValue(SESSION_RANDOM_VALUE));
327+
}
328+
return null;
329+
}
330+
}
331+
291332
private static class TypeValidator implements ErrorCodeValidator {
292333
public static final String TYPE = "typ";
293334
private final String expectedType;

0 commit comments

Comments
 (0)