Skip to content

Commit 29dc5ea

Browse files
vietjvietj
committed
Increase decoupling and move code to the place it should be
1 parent 1467f4c commit 29dc5ea

File tree

2 files changed

+52
-113
lines changed

2 files changed

+52
-113
lines changed

‎vertx-auth-common/src/main/java/io/vertx/ext/auth/impl/jose/JWK.java‎

Lines changed: 52 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
*/
1616
package io.vertx.ext.auth.impl.jose;
1717

18+
import io.vertx.core.VertxException;
1819
import io.vertx.core.buffer.Buffer;
1920
import io.vertx.core.internal.logging.Logger;
2021
import io.vertx.core.internal.logging.LoggerFactory;
@@ -82,6 +83,22 @@ private static PubKeySigningAlgorithm createPubKeySigningAlgorithm(Algorithm alg
8283
return PubKeySigningAlgorithm.createPubKeySigningAlgorithm(alg.name(), privateKey, null, null, alg.signatureProvider, length);
8384
}
8485

86+
private static char[] password(String keyStorePassword, Map<String, String> passwordProtection, String alias) {
87+
String password;
88+
if (passwordProtection == null || (password = passwordProtection.get(alias)) == null) {
89+
password = keyStorePassword;
90+
}
91+
return password.toCharArray();
92+
}
93+
94+
private static boolean invalidAlgAlias(String alg, String alias) {
95+
try {
96+
Algorithm algo = Algorithm.valueOf(alias);
97+
return !alg.equalsIgnoreCase(algo.jce) && !alg.equalsIgnoreCase(algo.oid);
98+
} catch (IllegalArgumentException e) {
99+
return true;
100+
}
101+
}
85102

86103
static final Logger LOG = LoggerFactory.getLogger(JWK.class);
87104

@@ -102,30 +119,40 @@ private static PubKeySigningAlgorithm createPubKeySigningAlgorithm(Algorithm alg
102119
private final Algorithm algo;
103120

104121
public static List<JWK> load(KeyStore keyStore, String keyStorePassword, Map<String, String> passwordProtection) {
105-
final List<Callable<SigningAlgorithm>> keys = SigningAlgorithm.create(keyStore, keyStorePassword, passwordProtection);
106-
return keys.stream().flatMap(fact -> {
122+
List<JWK> keys = new ArrayList<>();
123+
// load MACs
124+
for (String alias : Arrays.asList("HS256", "HS384", "HS512")) {
125+
// algorithm is valid
107126
try {
108-
SigningAlgorithm algo = fact.call();
109-
if (algo instanceof PubKeySigningAlgorithm) {
110-
PubKeySigningAlgorithm psa = (PubKeySigningAlgorithm) algo;
111-
return Stream.of(new JWK(psa.name(), psa.id(), psa));
112-
} else {
113-
MacSigningAlgorithm msa = (MacSigningAlgorithm) algo;
114-
return Stream.of(new JWK(msa));
127+
char[] password = password(keyStorePassword, passwordProtection, alias);
128+
MacSigningAlgorithm a = (MacSigningAlgorithm) SigningAlgorithm.create(keyStore, alias, password);
129+
// key store does not have the requested algorithm
130+
if (a != null) {
131+
// the algorithm cannot be null, and it cannot be different from the alias list
132+
if (invalidAlgAlias(a.name(), alias)) {
133+
throw new Exception("The key algorithm does not match: {" + alias + ": " + a.name() + "}");
134+
}
135+
keys.add(new JWK(a));
115136
}
116137
} catch (Exception e) {
117138
LOG.warn("Failed to load key for algorithm", e);
118-
return Stream.empty();
119139
}
120-
}).collect(Collectors.toList());
121-
}
122-
123-
private static char[] password(String keyStorePassword, Map<String, String> passwordProtection, String alias) {
124-
String password;
125-
if (passwordProtection == null || (password = passwordProtection.get(alias)) == null) {
126-
password = keyStorePassword;
127140
}
128-
return password.toCharArray();
141+
for (String alias : Arrays.asList("RS256", "RS384", "RS512", "ES256K", "ES256", "ES384", "ES512")) {
142+
try {
143+
char[] password = password(keyStorePassword, passwordProtection, alias);
144+
PubKeySigningAlgorithm a = (PubKeySigningAlgorithm) SigningAlgorithm.create(keyStore, alias, password);
145+
if (a != null) {
146+
if (invalidAlgAlias(a.signature().getAlgorithm(), alias)) {
147+
throw new Exception("The key algorithm does not match: {" + alias + ": " + a.signature().getAlgorithm() + "}");
148+
}
149+
keys.add(new JWK(a));
150+
}
151+
} catch (Exception e) {
152+
LOG.warn("Failed to load key for algorithm", e);
153+
}
154+
}
155+
return keys;
129156
}
130157

131158
/**
@@ -283,7 +310,9 @@ private JWK(MacSigningAlgorithm signingAlgo) throws NoSuchAlgorithmException, In
283310
}
284311
}
285312

286-
private JWK(String algorithm, String id, PubKeySigningAlgorithm signingAlg) throws NoSuchAlgorithmException {
313+
private JWK(PubKeySigningAlgorithm signingAlgo) throws NoSuchAlgorithmException {
314+
315+
String algorithm = signingAlgo.name();
287316

288317
try {
289318
algo = Algorithm.valueOf(algorithm);
@@ -292,28 +321,28 @@ private JWK(String algorithm, String id, PubKeySigningAlgorithm signingAlg) thro
292321
}
293322

294323
kid = null;
295-
label = signingAlg.canSign() ? algorithm + '#' + id + "-" + signingAlg.privateKey().hashCode() : algorithm + '#' + id;
324+
label = signingAlgo.canSign() ? algorithm + '#' + signingAlgo.id() + "-" + signingAlgo.privateKey().hashCode() : algorithm + '#' + signingAlgo.id();
296325
use = null;
297326

298327
switch (algo) {
299328
case RS256:
300329
case RS384:
301330
case RS512:
302331
kty = "RSA";
303-
signingAlgorithm = signingAlg;
332+
signingAlgorithm = signingAlgo;
304333
break;
305334
case PS256:
306335
case PS384:
307336
case PS512:
308337
kty = "RSASSA";
309-
signingAlgorithm = signingAlg;
338+
signingAlgorithm = signingAlgo;
310339
break;
311340
case ES256:
312341
case ES384:
313342
case ES512:
314343
case ES256K:
315344
kty = "EC";
316-
signingAlgorithm = wrapECAlgo(signingAlg);
345+
signingAlgorithm = wrapECAlgo(signingAlgo);
317346
break;
318347
default:
319348
throw new NoSuchAlgorithmException("Unknown algorithm: " + algorithm);

‎vertx-auth-common/src/main/java/io/vertx/ext/auth/impl/jose/algo/SigningAlgorithm.java‎

Lines changed: 0 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -22,23 +22,6 @@
2222

2323
public abstract class SigningAlgorithm {
2424

25-
private static char[] password(String keyStorePassword, Map<String, String> passwordProtection, String alias) {
26-
String password;
27-
if (passwordProtection == null || (password = passwordProtection.get(alias)) == null) {
28-
password = keyStorePassword;
29-
}
30-
return password.toCharArray();
31-
}
32-
33-
private static boolean invalidAlgAlias(String alg, String alias) {
34-
try {
35-
Algorithm algo = Algorithm.valueOf(alias);
36-
return !alg.equalsIgnoreCase(algo.jce) && !alg.equalsIgnoreCase(algo.oid);
37-
} catch (IllegalArgumentException e) {
38-
return true;
39-
}
40-
}
41-
4225
public static SigningAlgorithm create(KeyStore keyStore, String alias, char[] password) throws UnrecoverableEntryException, NoSuchAlgorithmException, KeyStoreException, CertificateNotYetValidException, CertificateExpiredException {
4326
KeyStore.Entry entry = keyStore.getEntry(alias, new KeyStore.PasswordProtection(password));
4427
if (entry != null) {
@@ -81,79 +64,6 @@ public static SigningAlgorithm create(KeyStore keyStore, String alias, char[] pa
8164
return null;
8265
}
8366

84-
public static List<Callable<SigningAlgorithm>> create(KeyStore keyStore, String keyStorePassword, Map<String, String> passwordProtection) {
85-
86-
class Failure implements Callable<SigningAlgorithm> {
87-
final Exception exception;
88-
Failure(String msg) {
89-
this.exception = VertxException.noStackTrace(msg);
90-
}
91-
Failure(Exception exception) {
92-
this.exception = exception;
93-
}
94-
@Override
95-
public SigningAlgorithm call() throws Exception {
96-
throw exception;
97-
}
98-
}
99-
100-
class Algo implements Callable<SigningAlgorithm> {
101-
final SigningAlgorithm algo;
102-
Algo(SigningAlgorithm algo) {
103-
this.algo = algo;
104-
}
105-
@Override
106-
public SigningAlgorithm call() throws Exception {
107-
return algo;
108-
}
109-
}
110-
111-
List<Callable<SigningAlgorithm>> keys = new ArrayList<>();
112-
113-
// TODO : merge the two for-each blocks
114-
115-
// load MACs
116-
for (String alias : Arrays.asList("HS256", "HS384", "HS512")) {
117-
// algorithm is valid
118-
try {
119-
char[] password = password(keyStorePassword, passwordProtection, alias);
120-
SigningAlgorithm a = create(keyStore, alias, password);
121-
// key store does not have the requested algorithm
122-
if (a == null) {
123-
continue;
124-
}
125-
// the algorithm cannot be null, and it cannot be different from the alias list
126-
if (invalidAlgAlias(a.name(), alias)) {
127-
keys.add(new Failure("The key algorithm does not match: {" + alias + ": " + a.name() + "}"));
128-
continue;
129-
}
130-
131-
keys.add(new Algo(a));
132-
} catch (Exception e) {
133-
keys.add(new Failure(e));
134-
}
135-
}
136-
137-
for (String alias : Arrays.asList("RS256", "RS384", "RS512", "ES256K", "ES256", "ES384", "ES512")) {
138-
try {
139-
char[] password = password(keyStorePassword, passwordProtection, alias);
140-
PubKeySigningAlgorithm a = (PubKeySigningAlgorithm) create(keyStore, alias, password);
141-
if (a == null) {
142-
continue;
143-
}
144-
if (invalidAlgAlias(a.signature().getAlgorithm(), alias)) {
145-
keys.add(new Failure("The key algorithm does not match: {" + alias + ": " + a.signature().getAlgorithm() + "}"));
146-
continue;
147-
}
148-
keys.add(new Algo(a));
149-
} catch (Exception e) {
150-
keys.add(new Failure(e));
151-
}
152-
}
153-
154-
return keys;
155-
}
156-
15767
public abstract String name();
15868

15969
public abstract String id();

0 commit comments

Comments
 (0)