Skip to content

Commit e7e9684

Browse files
peppelinuxpeppelinux
authored
Merge pull request #401 from italia/fix/metadata_jwk_check
X5C chain RP relation
2 parents b6a1a4d + 2dcf672 commit e7e9684

File tree

9 files changed

+228
-126
lines changed

9 files changed

+228
-126
lines changed

‎example/satosa/pyeudiw_backend.yaml‎

Lines changed: 89 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,18 @@ config:
129129
n: utqtxbs-jnK0cPsV7aRkkZKA9t4S-WSZa3nCZtYIKDpgLnR_qcpeF0diJZvKOqXmj2cXaKFUE-8uHKAHo7BL7T-Rj2x3vGESh7SG1pE0thDGlXj4yNsg0qNvCXtk703L2H3i1UXwx6nq1uFxD2EcOE4a6qDYBI16Zl71TUZktJwmOejoHl16CPWqDLGo9GUSk_MmHOV20m4wXWkB4qbvpWVY8H6b2a0rB1B1YPOs5ZLYarSYZgjDEg6DMtZ4NgiwZ-4N1aaLwyO-GLwt9Vf-NBKwoxeRyD3zWE2FXRFBbhKGksMrCGnFDsNl5JTlPjaM3kYyImE941ggcuc495m-Fw
130130
p: 2zmGXIMCEHPphw778YjVTar1eycih6fFSJ4I4bl1iq167GqO0PjlOx6CZ1-OdBTVU7HfrYRiUK_BnGRdPDn-DQghwwkB79ZdHWL14wXnpB5y-boHz_LxvjsEqXtuQYcIkidOGaMG68XNT1nM4F9a8UKFr5hHYT5_UIQSwsxlRQ0
131131
q: 2jMFt2iFrdaYabdXuB4QMboVjPvbLA-IVb6_0hSG_-EueGBvgcBxdFGIZaG6kqHqlB7qMsSzdptU0vn6IgmCZnX-Hlt6c5X7JB_q91PZMLTO01pbZ2Bk58GloalCHnw_mjPh0YPviH5jGoWM5RHyl_HDDMI-UeLkzP7ImxGizrM
132+
- kty: RSA
133+
use: sig
134+
alg: RS256
135+
kid: m00NPAelNBnG_wK2R5EpI_k-GWCHEUySamQYubgFjCg
136+
d: nMsnqz0lPHNGBgUqyuJ5nXQ0jh-mzs6d2xOY_QhpkRW1kEbexRJDdVV3fqMxj_s0MiF8mn-s8ea3e8cbNDgIy000Wvx05y1rMkB6KaZX2ZL5jwU7i_xP6NlLh8itikqJz7kKQSILgibQFFQDcScpEk8gUKa6fmSJQVwTII6GoJCdiJflv-FI2OQ_TCBQEEVVLpeUiVSP0n3OMUKGBlbaHOQkArUpla_ke_mtdfIrl7uB74Rxrin68KtFHkGDGdJPs-PPO1yJ2paFZI9QR_ettZ22v45c-qIgmCjsEnITDMaO9724PU_umlWsWe36Y9RAAzofKsjKqvA1OIzU03ob9Q
137+
n: sP6jt1XwJE0JDKxy4B7r3Jdb8W6bSRoVunyjWMgl5IafqFwHsJlYgCAWPeTrAL-iyjdnWC1csHuTqWjdndDL-oqEarrqoDAycVkfFTUTD81_wVhWUzAwxhQHiT7PTUIsV7m9VGlfC_kdCpQl5CcK1yx2nQ1KbqWOV1_5WnMgnN_EpNmztkZDnJmKedVduOb2dKWwnLS3fcGvUxXc87DjAzC2vfgQSoQfXAZbwItyS6OinFiUnBxRvt9ZY2IapjI1-wwDKKeRrqPC-fV2oWTrMqoYAvIDnf9AjKHAbIw7q301-7-eaUMF1hVtAz1XeXvMp0wK8_uSo9Vgv1vHhBpOwQ
138+
e: AQAB
139+
p: 0ViKTSyZdLtvbLBpTvVAXTdrhTwGXuh16PadQMAVmkoxOPiExRB5uLiy2ADaVKSglia5aQBUp9v0ygEEOmkiUtn5A26D9ui0dkPR0hx4fwqCOOmA2ZyDUNFJ_qrGSwT1SxGQDHeRteymJG7uN9QekS3XiBDgFJxwl-vVpoSTBJM
140+
q: 2HBr9qhVd3zZUQuNb7ro06ErLl4fhL-DiKsNqXB772tDNTJYeog1nOWgS22tcv5WHrSoYF1x5Q74YVoA6yVj6DwFx2Hc2pYZazzhYMRC3NAWkTEdroy9IjtpzKIpQIqw-sq8CbWVBXzho8uQBCdg8h73z11_HPyXT9BqQCmxJ9s
141+
dp: WsQ32rQuqNUnv4lRb4GYcZI41SCsZnQFw4dBsTRXaXknlFr0PfkhvXyfVlYwU6i5U8DgfO0-xzTwErGUIrs4vZFyjRFauDA3JlvLWn0rpXFp-sELM87PhLfpjDiBFz_EFtM7kJw7GhTMCFnsgVpAEpQ8sesXLPiTPNts2_D5SW8
142+
dq: jWlucLrtFGOjDRuyLjT9l__uWZ4vk6kZRHsWMwWGRBhd0ezx-CT0em1hPMcNE1vvYqKAfG2xU4pjaB_JB9nnG73TvMBI7xwwwWsGihXQ5bqjc_uWPAxCKpKM_qFYuI2lMkaxctqL4gkE1-LRVpVv9uGa4YZh3ct_BSvTr9ZNpA8
143+
qi: kn9Etj4a2erCUmoZUQalPjHxCRYm5Q3wAkFIRGSQADA51mkwQHyTYqXbHcmXn2ZgXBVI6XDWJB51Me-NCPfITTlusqxvATF7Q-QJtdK_FbgNtcVRNc1FMq_M7VBHA1i9wJR7T4t57aywfXPmlsA5TToTDRe-ybdw0C3ys4KQATs
132144

133145
#This is the configuration for the relaying party metadata
134146
metadata: &metadata
@@ -251,93 +263,93 @@ config:
251263
client_id_scheme: x509_san_dns # this will be prepended in the client id scheme used in the request.
252264
certificate_authorities:
253265
- ca.example.com: |
254-
-----BEGIN CERTIFICATE-----
255-
MIIDczCCAlugAwIBAgIUeroJ3EGn7QIEbcydLoOJ8aAS7FwwDQYJKoZIhvcNAQEL
256-
BQAwWjE2MDQGA1UEAwwtQ049aHR0cHM6Ly9jYS5leGFtcGxlLmNvbSwgTz1FeGFt
257-
cGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQswCQYDVQQGEwJJVDAe
258-
Fw0yNTAzMjYxMTQwNDBaFw0yNjAzMjcxMTQwNDBaMFoxNjA0BgNVBAMMLUNOPWh0
259-
dHBzOi8vY2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwgQz1JVDETMBEGA1UE
260-
CgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwggEiMA0GCSqGSIb3DQEBAQUAA4IB
261-
DwAwggEKAoIBAQC6tNNMkVbyZonwHW/Ho7P6n7nF+OwkGG9Vc/tL1Xhquc8uug4U
262-
S8HB857hVR0ojEsLlJ1DPcsyt3CXGcK6P7cmcw4zQi5v5dkjafD1VEg9egiJFfAD
263-
AVAFGlljqHWARo3xjceUAY0Vk88cPae3uGV8wBDKj41HNOP166S5ozxxRIYstkTh
264-
cqNdSGHkImbK3fOHo5Ai54QqDFfGcanCUJLxy8Un5e4TMIGDiESoh2T+m4KWK3SI
265-
WHM8de2kiBi6PfHpq1rrjc3q/DaW0WToaCfkI5/EkHrbTeCux6nso2TE0/UG2kNu
266-
VqAVU1BqcJ8ZBm8P04jFiTRnlsNtUB8wBPSRAgMBAAGjMTAvMBIGA1UdEwEB/wQI
267-
MAYBAf8CAQEwGQYDVR0RBBIwEIIOY2EuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQEL
268-
BQADggEBAHC69qK8Lms8gd8vBjlD1okImZ12R9eIbfJn4bsjbdkXYoQp6kyW7PJE
269-
WbyCgUfiYXKMQfmXCN1OVzIjao8tWe+r2VpYVF6jw0l+nZCewHzAWFSbnLNuRSZZ
270-
kMTzrWD6O6KelV/V2g8FAx7yhDieHleKeFkmownqFPRSTF5Uj5p9glny9PApQUNI
271-
2Pvxy2Xewze5o3EKOdypv/z8A4gKCfztz8Jn51awjfKsCq6EBuHp3GkkgurJgU94
272-
Gev1U1YIGjcsFh0m5KUoLO5VRqjzNpdEWPcgIU4+iqpHfS7PEDb2QNEZKwnE7YFx
273-
sOz7pgjS1lS+KeLbt9gzcVRtRA3FOlA=
274-
-----END CERTIFICATE-----
266+
-----BEGIN CERTIFICATE-----
267+
MIIDYzCCAkugAwIBAgIUHVMNJD9vqAA4mR+QAJyEQFW4kjQwDQYJKoZIhvcNAQEL
268+
BQAwUjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwg
269+
Qz1JVDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNDAz
270+
MTU0NzU2WhcNMjYwNDA0MTU0NzU2WjBSMS4wLAYDVQQDDCVDTj1jYS5leGFtcGxl
271+
LmNvbSwgTz1FeGFtcGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQsw
272+
CQYDVQQGEwJJVDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMf3zvlY
273+
zX1DYgv9QjRusMQjSRNdZi72/ydnxO/cAQ1GsgLZ8ewqIL1CnXtIs6i2F8poUOec
274+
g957xk1db6sTqEWXRi5h9IfMUFcd5G7gIbJzjXCiLSVz6m9vZlvqR7BDka1VQhuH
275+
rW2xEIE6+F2lWxJ+crimea/c5VlMKBCh+gQldFq3lTu6smGUz8xl8rhleBPgTgZz
276+
TO4VuVO1dOb/S4lq9twfVYCTznF9vgaNaNh3la7yjzCf+zpSTGQD8TFO8ws1SZRq
277+
O0bkabW8/5XsnwFHLT2LMSPkWMgMD8r+7xef93bvbEy7SA4Hw1Iow2xIIcTDYQ7F
278+
77HQ3OjkogHmhrMCAwEAAaMxMC8wEgYDVR0TAQH/BAgwBgEB/wIBATAZBgNVHREE
279+
EjAQgg5jYS5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEApRUUxw5Dn0wd
280+
lFPApjn7n/SZyx5I1XnOHOIk8aWD0KFFa1zsnONlmRDgC8EQ5XKw3nMUwvnCQUR8
281+
6FmrqP5gINHdqfvWiitC0eQdDhMhIHvdfUMBicgZ0XDVjDZhD6W9A+IWwR3ySLCf
282+
lZHA5JwjYhpAjMYFXwSVZklOre34zJL6CRwgIUKjc9uyGPmlnVRFTUcUqLB9Uq/U
283+
dFc7XMPBAbMt1frOJRj6P1OFtubuC0INpEhzivg3+w8bXmpEN6e2hBvIjoNkgnWF
284+
O6HVbDnJXTA34/I4snisJfZQ+Z9gln921+2Q27sMvyS7aBqtocDuWB0w3XZ3aCYk
285+
DTEzMjUtQA==
286+
-----END CERTIFICATE-----
275287
relying_party_certificate_chains_by_ca: # chains can be formed by items serialized in binary python serialization or PEM
276288
ca.example.com:
277289
- |
278290
-----BEGIN CERTIFICATE-----
279-
MIIDeDCCAmCgAwIBAgIUNUYqcuiqU4ykUo5Ttg0IGoNxV2swDQYJKoZIhvcNAQEL
291+
MIIDfzCCAmegAwIBAgIUN3niXMK8XOjhIvf6EUD4sz80XIkwDQYJKoZIhvcNAQEL
280292
BQAwTjEpMCcGA1UEAwwgaHR0cHM6Ly9pbnRlcm1lZGlhdGUuZXhhbXBsZS5uZXQx
281-
FDASBgNVBAoMC0V4YW1wbGUgSU5UMQswCQYDVQQGEwJJVDAeFw0yNTAzMjYxMTQw
282-
NDBaFw0yNjAzMjcxMTQwNDBaMEwxJjAkBgNVBAMMHWh0dHBzOi8vZXhhbXBsZS5j
283-
b20vT3BlbklENFZQMRUwEwYDVQQKDAxFeGFtcGxlIExlYWYxCzAJBgNVBAYTAklU
284-
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwnGyRgJ2pMeugkadV9+H
285-
Y5Rzy/7lNVh+yUnM2MK+OU+RT3yFbk9ZmCOlfnXITq8oWJJ7moKF0izpvlMEyFLM
286-
Bqe1JlI3LmiEenAsQqc9uau1ywMaIYWqbOLb/YYlMW8JJFhXxSw12U9Dg3kwXGRG
287-
OO2x4WK0nqyhQfatsHrKpS2DeSeOnVAKLaUXHNFiM545C9HgkrqhTFoaWO5vgU0E
288-
OhLzm6+Gffawk+X5SOy3Vr7QAe9zV8kzz3uxHyFq4QXoPQm3ieeMve7MtdHJPMwO
289-
jEor/cqsjvYdcf9DuLXvQa9xNHOHqAnoRWQpC2LzFaqYOllw42aDh07qpd1Se+fw
290-
HQIDAQABo1AwTjAMBgNVHRMBAf8EAjAAMD4GA1UdEQQ3MDWCEGxlYWYuZXhhbXBs
291-
ZS5vcmeGIWh0dHBzOi9sZWFmLmV4YW1wbGUub3JnL09wZW5JRDRWUDANBgkqhkiG
292-
9w0BAQsFAAOCAQEAdkNPzeJETSpoKyjpW2/OWuWREvWv0aNDqKP1LQ6CLn98/Qb8
293-
s7TlW3PoZctjYnMQaSyG7Ywf5tNScvy0xhr1pMbEoZUwCguaCOoyQan7oI9a7eMq
294-
6eyuIyKGRcU+GLeBD7POy34w6GYD64wbeRdfviDWR+falrfO5QFsFN16RXZedI2y
295-
hJAmye2FrK1WmBN5twLCCWxhI08Z9T07EERBAjYh+eJN08OK67RVxj1ytyeECvGt
296-
oCV2JvmKyDWIueI0i+o0Gw+845PoBR424uqs34LtUhMpOhaL6eW+qYNMKLHBEt2d
297-
GZHaVPn/Gvmiw4vpoJSODfhujGcNiZ7GgwPyoA==
298-
-----END CERTIFICATE-----
293+
FDASBgNVBAoMC0V4YW1wbGUgSU5UMQswCQYDVQQGEwJJVDAeFw0yNTA0MDMxNTQ3
294+
NTZaFw0yNjA0MDQxNTQ3NTZaMFcxMTAvBgNVBAMMKENOPWVhZi5leGFtcGxlLmNv
295+
bSwgTz1FeGFtcGxlIExlYWYsIEM9SVQxFTATBgNVBAoMDEV4YW1wbGUgTGVhZjEL
296+
MAkGA1UEBhMCSVQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCw/qO3
297+
VfAkTQkMrHLgHuvcl1vxbptJGhW6fKNYyCXkhp+oXAewmViAIBY95OsAv6LKN2dY
298+
LVywe5OpaN2d0Mv6ioRquuqgMDJxWR8VNRMPzX/BWFZTMDDGFAeJPs9NQixXub1U
299+
aV8L+R0KlCXkJwrXLHadDUpupY5XX/lacyCc38Sk2bO2RkOcmYp51V245vZ0pbCc
300+
tLd9wa9TFdzzsOMDMLa9+BBKhB9cBlvAi3JLo6KcWJScHFG+31ljYhqmMjX7DAMo
301+
p5Guo8L59XahZOsyqhgC8gOd/0CMocBsjDurfTX7v55pQwXWFW0DPVd5e8ynTArz
302+
+5Kj1WC/W8eEGk7BAgMBAAGjTDBKMAwGA1UdEwEB/wQCMAAwOgYDVR0RBDMwMYIQ
303+
bGVhZi5leGFtcGxlLm9yZ4YdaHR0cHM6Ly9leGFtcGxlLmNvbS9PcGVuSUQ0VlAw
304+
DQYJKoZIhvcNAQELBQADggEBACF2aoCODW4tziNQs41C9N363xYPt21uIQy0CQ24
305+
1hRZ8Ev6yIQ/WORfzciLHZsWizZdS3D5oDY7K+WAgMpDSR0Ah9dXMfJjOxcUib57
306+
Zh+YOi443fjU/5/DBHyHgfEvDy1QXXHJuDbgchzAv9u8uY0ibUb/GHy4OKaj9bOI
307+
8g6qgZtT2wkfdHQPX+fpwZueTaHhoXJV+JTuE227fIjLZ5ThbvO0xbE3q4I/v+Gu
308+
ZZ713LQaG2RwdJWTimJUi6Sro5s0YR6qRGejHmiS1FbJOOG4AAE4PkhkxVogItVE
309+
Z4nqCEfD1RT6iwiWyXIYh3cNpWvcE3t4j7e/Su5IhW/Cv2E=
310+
-----END CERTIFICATE-----
299311
- |
300312
-----BEGIN CERTIFICATE-----
301-
MIIDTDCCAjSgAwIBAgIUT+PLvboczsg8KU9lbTg/fjG+NPwwDQYJKoZIhvcNAQEL
302-
BQAwWjE2MDQGA1UEAwwtQ049aHR0cHM6Ly9jYS5leGFtcGxlLmNvbSwgTz1FeGFt
303-
cGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQswCQYDVQQGEwJJVDAe
304-
Fw0yNTAzMjYxMTQwNDBaFw0yNjAzMjcxMTQwNDBaME4xKTAnBgNVBAMMIGh0dHBz
305-
Oi8vaW50ZXJtZWRpYXRlLmV4YW1wbGUubmV0MRQwEgYDVQQKDAtFeGFtcGxlIElO
306-
VDELMAkGA1UEBhMCSVQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDY
307-
USM22wKlweYWyXAIq+oZDZ84X5TrPkyUxsZ3VfLGqWG5RHKQPBiX1eHWD9kPBRem
308-
qCMhX7WGjDV2EEt4J0RsfL7zigqpy6qu3Tp0nvaDIU8SBQdJ+bHCheONQb+LUEYK
309-
wHz+U+ZBGrAUTOy+QOFdhs/mmOWgko2zTIOfsTSjGzTNYZ1cxQoZ549QhOkr1E5P
310-
gUz09+RAsM3PS944i83LFHfYJUnm8SQQu5g0YivIGCvcb6OlLT4LM0PJf7m+raa4
311-
dFOz1HM9n7NBFRo8p4QTuHwXt3PfQu38DJVvWTttanWldXbQ2sCtc6xGjKOJAbTe
312-
Q7JqOI48VLwx/a6t+mE1AgMBAAGjFjAUMBIGA1UdEwEB/wQIMAYBAf8CAQAwDQYJ
313-
KoZIhvcNAQELBQADggEBAG4Gc6Q7QkE+eu8ITd7WW5aMBwlgkOjFy/Xp3yD9tEwN
314-
XREjcze0yDgMptbVrgmhlRqZ8dks+kONwuaH9YqfmuFWxUXvrXpapdnyJhBNVXkI
315-
ja1EJM+7UFNOIWPXqdlEBgaJLjNwUqofbGae9IX7QCQUTL4cScGSXZ1KsEPlkajw
316-
ru0r9QVtTOREjJQ6jqjFCEcWSu9qdD33PrSQSb66AqN+NSfVSKEJllJp1BRrSanK
317-
+ZnOCecmXloVWBaXK4J4ViXEVlK5u0iI+HUcuMtueHbAV1tLfYJv+sVisc5HaAAO
318-
9Eawugj049LBHWIcX4Z28+5LYqqhSEKdIqLBw9NJ8Cs=
313+
MIIDRDCCAiygAwIBAgIUUOBXQmkRjQvfhU1YJbMEOMnPxvQwDQYJKoZIhvcNAQEL
314+
BQAwUjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwg
315+
Qz1JVDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNDAz
316+
MTU0NzU2WhcNMjYwNDA0MTU0NzU2WjBOMSkwJwYDVQQDDCBodHRwczovL2ludGVy
317+
bWVkaWF0ZS5leGFtcGxlLm5ldDEUMBIGA1UECgwLRXhhbXBsZSBJTlQxCzAJBgNV
318+
BAYTAklUMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsSUAY+mCs1eB
319+
/hWKtF0kncwTRn3jgczjZWmUSSBZT3PzqmD9uqlgEBrv2sOGwO4bBDnutCAHhfnl
320+
2gXifvg2PJHQWu/g1kVY396K+d91nrqQhUabo2cpEca66t7InPMnXkMR5DG6rNP6
321+
l05OLKQIvoTaHzef0rAS4f+5gF7IcRtGq9G8QRnd2lwLmDYRPKY3jp/uvLosOatv
322+
Nx5p2XtxETgOSv4GEtjax3jxkMDIIPrHwTJGWwsGvasEI5lQ/G67OjFZjjSaoJ95
323+
SSPhXoIydmOmXKDN3GY7ZqT9HntuSzyB3GZ4DMLyOdZdvYvt08hUCJnnY0kGhhtW
324+
gW0xb/wyKwIDAQABoxYwFDASBgNVHRMBAf8ECDAGAQH/AgEAMA0GCSqGSIb3DQEB
325+
CwUAA4IBAQBAwwumBWSI/guarZsNd8hEOVZ7dWRQDLxfDZB1jKtgqA2jCEbNGwpY
326+
41NRRfkTi9EfZXXVdbk9xrjNWVsGdDn/Kh/1/b4uatu2ocRG5R3e2KkZMaK1/Ru2
327+
LFP6gvi7i8dvEr8IQqlg+CrEb11CjMXZi36jRZhtSUnUfmUR4hqCN/qzALdiKvHS
328+
NpEu0D6x6l7YEhwtpX7bvWdnEzCUrAUltMPO9pZUR1LBSPTCMSd+vUhJw/84EJEg
329+
D6Lw8OxzYyzSNOrGTqfplqlHrD/WpI6DB6Yq4Rpefz84AWraGVtZbYAlQMyK1EKS
330+
C3Lef0OGQC0anzAXDsGr1As8HdEuSngu
319331
-----END CERTIFICATE-----
320332
- |
321333
-----BEGIN CERTIFICATE-----
322-
MIIDczCCAlugAwIBAgIUeroJ3EGn7QIEbcydLoOJ8aAS7FwwDQYJKoZIhvcNAQEL
323-
BQAwWjE2MDQGA1UEAwwtQ049aHR0cHM6Ly9jYS5leGFtcGxlLmNvbSwgTz1FeGFt
324-
cGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQswCQYDVQQGEwJJVDAe
325-
Fw0yNTAzMjYxMTQwNDBaFw0yNjAzMjcxMTQwNDBaMFoxNjA0BgNVBAMMLUNOPWh0
326-
dHBzOi8vY2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwgQz1JVDETMBEGA1UE
327-
CgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwggEiMA0GCSqGSIb3DQEBAQUAA4IB
328-
DwAwggEKAoIBAQC6tNNMkVbyZonwHW/Ho7P6n7nF+OwkGG9Vc/tL1Xhquc8uug4U
329-
S8HB857hVR0ojEsLlJ1DPcsyt3CXGcK6P7cmcw4zQi5v5dkjafD1VEg9egiJFfAD
330-
AVAFGlljqHWARo3xjceUAY0Vk88cPae3uGV8wBDKj41HNOP166S5ozxxRIYstkTh
331-
cqNdSGHkImbK3fOHo5Ai54QqDFfGcanCUJLxy8Un5e4TMIGDiESoh2T+m4KWK3SI
332-
WHM8de2kiBi6PfHpq1rrjc3q/DaW0WToaCfkI5/EkHrbTeCux6nso2TE0/UG2kNu
333-
VqAVU1BqcJ8ZBm8P04jFiTRnlsNtUB8wBPSRAgMBAAGjMTAvMBIGA1UdEwEB/wQI
334-
MAYBAf8CAQEwGQYDVR0RBBIwEIIOY2EuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQEL
335-
BQADggEBAHC69qK8Lms8gd8vBjlD1okImZ12R9eIbfJn4bsjbdkXYoQp6kyW7PJE
336-
WbyCgUfiYXKMQfmXCN1OVzIjao8tWe+r2VpYVF6jw0l+nZCewHzAWFSbnLNuRSZZ
337-
kMTzrWD6O6KelV/V2g8FAx7yhDieHleKeFkmownqFPRSTF5Uj5p9glny9PApQUNI
338-
2Pvxy2Xewze5o3EKOdypv/z8A4gKCfztz8Jn51awjfKsCq6EBuHp3GkkgurJgU94
339-
Gev1U1YIGjcsFh0m5KUoLO5VRqjzNpdEWPcgIU4+iqpHfS7PEDb2QNEZKwnE7YFx
340-
sOz7pgjS1lS+KeLbt9gzcVRtRA3FOlA=
334+
MIIDYzCCAkugAwIBAgIUHVMNJD9vqAA4mR+QAJyEQFW4kjQwDQYJKoZIhvcNAQEL
335+
BQAwUjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwg
336+
Qz1JVDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNDAz
337+
MTU0NzU2WhcNMjYwNDA0MTU0NzU2WjBSMS4wLAYDVQQDDCVDTj1jYS5leGFtcGxl
338+
LmNvbSwgTz1FeGFtcGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQsw
339+
CQYDVQQGEwJJVDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMf3zvlY
340+
zX1DYgv9QjRusMQjSRNdZi72/ydnxO/cAQ1GsgLZ8ewqIL1CnXtIs6i2F8poUOec
341+
g957xk1db6sTqEWXRi5h9IfMUFcd5G7gIbJzjXCiLSVz6m9vZlvqR7BDka1VQhuH
342+
rW2xEIE6+F2lWxJ+crimea/c5VlMKBCh+gQldFq3lTu6smGUz8xl8rhleBPgTgZz
343+
TO4VuVO1dOb/S4lq9twfVYCTznF9vgaNaNh3la7yjzCf+zpSTGQD8TFO8ws1SZRq
344+
O0bkabW8/5XsnwFHLT2LMSPkWMgMD8r+7xef93bvbEy7SA4Hw1Iow2xIIcTDYQ7F
345+
77HQ3OjkogHmhrMCAwEAAaMxMC8wEgYDVR0TAQH/BAgwBgEB/wIBATAZBgNVHREE
346+
EjAQgg5jYS5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEApRUUxw5Dn0wd
347+
lFPApjn7n/SZyx5I1XnOHOIk8aWD0KFFa1zsnONlmRDgC8EQ5XKw3nMUwvnCQUR8
348+
6FmrqP5gINHdqfvWiitC0eQdDhMhIHvdfUMBicgZ0XDVjDZhD6W9A+IWwR3ySLCf
349+
lZHA5JwjYhpAjMYFXwSVZklOre34zJL6CRwgIUKjc9uyGPmlnVRFTUcUqLB9Uq/U
350+
dFc7XMPBAbMt1frOJRj6P1OFtubuC0INpEhzivg3+w8bXmpEN6e2hBvIjoNkgnWF
351+
O6HVbDnJXTA34/I4snisJfZQ+Z9gln921+2Q27sMvyS7aBqtocDuWB0w3XZ3aCYk
352+
DTEzMjUtQA==
341353
-----END CERTIFICATE-----
342354
343355
private_keys: *metadata_jwks

‎pyeudiw/jwk/parse.py‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
from cryptojwt.jwk.ec import import_ec_key, ECKey
22
from cryptojwt.jwk.rsa import RSAKey, import_rsa_key
3+
from ssl import DER_cert_to_PEM_cert
34

45
from pyeudiw.jwk import JWK
56
from pyeudiw.jwk.exceptions import InvalidJwk
@@ -44,6 +45,24 @@ def parse_pem(pem: str) -> JWK:
4445

4546
raise InvalidJwk(f"unable to parse key from pem: {pem}")
4647

48+
def parse_certificate(cert: str | bytes) -> JWK:
49+
"""
50+
Parse a key from a x509 PEM or DER certificate.
51+
52+
:param cert: x509 certificate in PEM or DER format
53+
:type cert: str | bytes
54+
55+
:raises InvalidJwk: if the key cannot be parsed from the certificate
56+
57+
:return: JWK object
58+
:rtype: JWK
59+
"""
60+
61+
if type(cert) == bytes or type(cert) == str and not cert.startswith("-----BEGIN CERTIFICATE-----"):
62+
cert = DER_cert_to_PEM_cert(cert)
63+
64+
return parse_pem(cert)
65+
4766
def parse_x5c_keys(x5c: list[str]) -> list[JWK]:
4867
"""
4968
Parse a the keys from a x5c chain.

‎pyeudiw/jwt/helper.py‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,13 @@
2020

2121

2222
class JWHelperInterface:
23-
def __init__(self, jwks: list[KeyLike | dict] | KeyLike | dict):
23+
def __init__(self, jwks: list[KeyLike | dict] | KeyLike | dict) -> None:
2424
"""
2525
Creates an instance of JWEHelper.
2626
27-
:param jwks: The list of JWK used to crypt and encrypt the content of JWE.
27+
:raises TypeError: If the input jwks is not a list, dict, or a key-like object.
2828
29+
:param jwks: The list of JWK used to crypt and encrypt the content of JWE.
2930
"""
3031
self.jwks: list[KeyLike] = []
3132
if isinstance(jwks, dict):
@@ -43,6 +44,14 @@ def __init__(self, jwks: list[KeyLike | dict] | KeyLike | dict):
4344
raise TypeError(f"unable to handle input jwks with type {type(jwks)}")
4445

4546
def get_jwk_by_kid(self, kid: str) -> KeyLike | None:
47+
"""
48+
Returns the JWK with the given kid from the list of JWKs.
49+
50+
:param kid: The key ID of the JWK to retrieve.
51+
:type kid: str
52+
:returns: The JWK with the given kid, or None if not found.
53+
:rtype: KeyLike | None
54+
"""
4655
if not kid:
4756
return None
4857
for i in self.jwks:

‎pyeudiw/jwt/jws_helper.py‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,11 @@ def sign(
101101
unprotected = {}
102102

103103
# Select the signing key
104-
# TODO: check that singing key is either private or symmetric
105104
signing_key = self._select_signing_key((protected, unprotected), signing_kid)
106105

106+
if signing_key["kty"] == "oct":
107+
raise JWSSigningError(f"Key {signing_key['kid']} is a symmetric key")
108+
107109
# Ensure the key ID in the header matches the signing key
108110
header_kid = protected.get("kid")
109111
signer_kid = signing_key.get("kid")
@@ -134,8 +136,13 @@ def sign(
134136
signing_key = deepcopy(signing_key)
135137
signing_key.pop("kid", None)
136138

139+
signing_key_jwk = key_from_jwk_dict(signing_key)
140+
141+
if not signing_key_jwk.priv_key:
142+
raise JWSSigningError(f"Key {signing_key_jwk.kid} is not a private key")
143+
137144
signer = JWS(payload, alg=signing_alg)
138-
keys = [key_from_jwk_dict(signing_key)]
145+
keys = [signing_key_jwk]
139146

140147
if serialization_format == "compact":
141148
try:

0 commit comments

Comments
 (0)