SecurityService Use Issuer for token, if no kid available

Author: whamm86

src/AasSecurity/SecurityHelper.cs

@@ -13,6 +13,7 @@
 
 using AasxServer;
 using Extensions;
+using Microsoft.IdentityModel.Tokens;
 using System.Security.Cryptography.X509Certificates;
 
 namespace AasSecurity
@@ -93,18 +94,20 @@ private static void ParseSecurityMetamodel()
             return null;
         }
 
-        internal static string? FindServerJwksUrl(string kid, out string domain)
+        internal static string? FindServerJwksUrl(string kid, string iss, out string domain)
         {
             domain = "";
             if (GlobalSecurityVariables.ServerKid != null)
             {
                 for (var i = 0; i < GlobalSecurityVariables.ServerKid.Count; i++)
                 {
-                    if (GlobalSecurityVariables.ServerKid[i] == kid)
+                    if ((GlobalSecurityVariables.ServerKid[i] != "" &&
+                        GlobalSecurityVariables.ServerKid[i] == kid)
+                        || GlobalSecurityVariables.ServerJwksUrl[i] == iss)
                     {
                         domain = GlobalSecurityVariables.ServerDomain[i];
                         return GlobalSecurityVariables.ServerJwksUrl[i];
-                    }
+                    }
                 }
             }
 

src/AasSecurity/SecurityService.cs

@@ -482,7 +482,7 @@ private string HandleBearerToken(string? bearerToken, ref string user, ref bool
                             var kid = jwtSecurityToken.Header["kid"].ToString();
                             if (kid != null)
                             {
-                                jwksUrl = SecurityHelper.FindServerJwksUrl(kid, out domain);
+                                jwksUrl = SecurityHelper.FindServerJwksUrl(kid, iss, out domain);
                             }
                             if (!jwksUrl.IsNullOrEmpty())
                             {

src/AasSecurity/SecuritySettingsForServerParser.cs

@@ -168,9 +168,6 @@ private static void ParseAuthenticationServer(AdminShellPackageEnv env, Submodel
                 XNamespace ns = "http://uri.etsi.org/02231/v2#"; // <- critical
                                                                  // (There's also an XMLDSIG signature later in a different ns; we can ignore it.)
 
-                XNamespace nsDs = "http://www.w3.org/2000/09/xmldsig#";   // XMLDSIG ns (for <Signature>)
-
-
                 // Navigate to <TrustServiceProviderList>
                 var tspList = doc
                     .Root                             // <TrustServiceStatusList>
@@ -227,8 +224,14 @@ private static void ParseAuthenticationServer(AdminShellPackageEnv env, Submodel
                 foreach (var provider in providers)
                 {
                     var serverName = provider?.Service?.Name;
+                    Console.WriteLine(" serverName: " + serverName);
+
                     var domain = provider?.Domain;
+                    Console.WriteLine("  domain: " + domain);
+
                     var jwks = provider?.Service?.SupplyPoint;
+                    Console.WriteLine("  jwks: " + jwks);
+
                     var kid = "";
 
                     GlobalSecurityVariables.ServerCertificates.Add(null);

src/AasxServerBlazor/trustlist.txt

@@ -112,8 +112,3 @@ kooy8pxAjM5YUv+GDZdu3ojEdtDtTeZewiAXVCcDeUSLb+q2ogB2GTbYkuBSebhZ
 BmNbiHJ541E5aeIXKj1Ksdv6fUgYvzXgASKfjpq3l+bD7XSBbIAp9mMYl/pi0C8D
 ejiwt3d6N936huydhEwz
 -----END CERTIFICATE-----
-
-# Token exchange
-serverName: STS
-jwks: https://iam-security-training.com/sts
-kid: demo-key