Skip to content

Commit 66602d7

Browse files
SanderKondratjevNortalSanderKondratjevNortal
committed
NFC-102 Add web-eid-1.1 token support
1 parent bc90006 commit 66602d7

17 files changed

+1455
-130
lines changed

‎src/authtoken/SupportedSignatureAlgorithm.php‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
<?php
2+
3+
/*
4+
* Copyright (c) 2025-2025 Estonian Information System Authority
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining a copy
7+
* of this software and associated documentation files (the "Software"), to deal
8+
* in the Software without restriction, including without limitation the rights
9+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
* copies of the Software, and to permit persons to whom the Software is
11+
* furnished to do so, subject to the following conditions:
12+
*
13+
* The above copyright notice and this permission notice shall be included in all
14+
* copies or substantial portions of the Software.
15+
*
16+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
* SOFTWARE.
23+
*/
24+
25+
namespace web_eid\web_eid_authtoken_validation_php\authtoken;
26+
27+
class SupportedSignatureAlgorithm
28+
{
29+
private string $cryptoAlgorithm;
30+
private string $hashFunction;
31+
private string $paddingScheme;
32+
33+
public function __construct(
34+
string $cryptoAlgorithm = '',
35+
string $hashFunction = '',
36+
string $paddingScheme = ''
37+
) {
38+
$this->cryptoAlgorithm = $cryptoAlgorithm;
39+
$this->hashFunction = $hashFunction;
40+
$this->paddingScheme = $paddingScheme;
41+
}
42+
43+
public function getCryptoAlgorithm(): string
44+
{
45+
return $this->cryptoAlgorithm;
46+
}
47+
48+
public function setCryptoAlgorithm(string $cryptoAlgorithm): void
49+
{
50+
$this->cryptoAlgorithm = $cryptoAlgorithm;
51+
}
52+
53+
public function getHashFunction(): string
54+
{
55+
return $this->hashFunction;
56+
}
57+
58+
public function setHashFunction(string $hashFunction): void
59+
{
60+
$this->hashFunction = $hashFunction;
61+
}
62+
63+
public function getPaddingScheme(): string
64+
{
65+
return $this->paddingScheme;
66+
}
67+
68+
public function setPaddingScheme(string $paddingScheme): void
69+
{
70+
$this->paddingScheme = $paddingScheme;
71+
}
72+
73+
public static function fromArray(array $data): self
74+
{
75+
return new self(
76+
$data['cryptoAlgorithm'] ?? '',
77+
$data['hashFunction'] ?? '',
78+
$data['paddingScheme'] ?? ''
79+
);
80+
}
81+
82+
public function toArray(): array
83+
{
84+
return [
85+
'cryptoAlgorithm' => $this->cryptoAlgorithm,
86+
'hashFunction' => $this->hashFunction,
87+
'paddingScheme' => $this->paddingScheme,
88+
];
89+
}
90+
}

‎src/authtoken/WebEidAuthToken.php‎

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22

33
/*
4-
* Copyright (c) 2022-2024 Estonian Information System Authority
4+
* Copyright (c) 2022-2025 Estonian Information System Authority
55
*
66
* Permission is hereby granted, free of charge, to any person obtaining a copy
77
* of this software and associated documentation files (the "Software"), to deal
@@ -48,6 +48,13 @@ class WebEidAuthToken
4848
* @var string Format
4949
*/
5050
private ?string $format = null;
51+
/**
52+
* @var string Unverfied signing certificate
53+
*/
54+
private ?string $unverifiedSigningCertificate = null;
55+
56+
/** @var SupportedSignatureAlgorithm[] */
57+
private array $supportedSignatureAlgorithms = [];
5158

5259
public function __construct(string $authenticationTokenJSON)
5360
{
@@ -72,6 +79,17 @@ public function __construct(string $authenticationTokenJSON)
7279
if (isset($jsonDecoded['format'])) {
7380
$this->format = $this->filterString('format', $jsonDecoded['format']);
7481
}
82+
// unverifiedSigningCertificate
83+
if (isset($jsonDecoded['unverifiedSigningCertificate'])) {
84+
$this->unverifiedSigningCertificate =
85+
$this->filterString('unverifiedSigningCertificate', $jsonDecoded['unverifiedSigningCertificate']);
86+
}
87+
// supportedSignatureAlgorithms
88+
if (isset($jsonDecoded['supportedSignatureAlgorithms'])) {
89+
$this->supportedSignatureAlgorithms = $this->parseSupportedSignatureAlgorithms(
90+
$jsonDecoded['supportedSignatureAlgorithms']
91+
);
92+
}
7593
}
7694

7795
public function getUnverifiedCertificate(): ?string
@@ -94,6 +112,16 @@ public function getFormat(): ?string
94112
return $this->format;
95113
}
96114

115+
public function getUnverifiedSigningCertificate(): ?string
116+
{
117+
return $this->unverifiedSigningCertificate;
118+
}
119+
120+
public function getSupportedSignatureAlgorithms(): array
121+
{
122+
return $this->supportedSignatureAlgorithms;
123+
}
124+
97125
private function filterString(string $key, $data): string
98126
{
99127
$type = gettype($data);
@@ -102,4 +130,21 @@ private function filterString(string $key, $data): string
102130
}
103131
return $data;
104132
}
133+
134+
private function parseSupportedSignatureAlgorithms(array $list): array
135+
{
136+
$result = [];
137+
138+
foreach ($list as $item) {
139+
if (!is_array($item)) {
140+
throw new UnexpectedValueException(
141+
"Error parsing supportedSignatureAlgorithms: each item must be an object"
142+
);
143+
}
144+
145+
$result[] = SupportedSignatureAlgorithm::fromArray($item);
146+
}
147+
148+
return $result;
149+
}
105150
}

‎src/certificate/CertificateLoader.php‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22

33
/*
4-
* Copyright (c) 2022-2024 Estonian Information System Authority
4+
* Copyright (c) 2022-2025 Estonian Information System Authority
55
*
66
* Permission is hereby granted, free of charge, to any person obtaining a copy
77
* of this software and associated documentation files (the "Software"), to deal
@@ -59,4 +59,24 @@ public static function loadCertificatesFromResources(string ...$resourceNames):
5959
}
6060
return $caCertificates;
6161
}
62+
63+
/**
64+
* @throws CertificateDecodingException
65+
*/
66+
public static function decodeCertificateFromBase64(string $base64): X509
67+
{
68+
$cert = new X509();
69+
70+
if (!str_starts_with($base64, '-----BEGIN CERTIFICATE-----')) {
71+
$base64 = "-----BEGIN CERTIFICATE-----\n" .
72+
chunk_split($base64, 64) .
73+
"-----END CERTIFICATE-----\n";
74+
}
75+
76+
if (!$cert->loadX509($base64)) {
77+
throw new CertificateDecodingException("unverifiedSigningCertificate is not base64 encoded");
78+
}
79+
80+
return $cert;
81+
}
6282
}

‎src/validator/AuthTokenValidator.php‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22

33
/*
4-
* Copyright (c) 2022-2024 Estonian Information System Authority
4+
* Copyright (c) 2022-2025 Estonian Information System Authority
55
*
66
* Permission is hereby granted, free of charge, to any person obtaining a copy
77
* of this software and associated documentation files (the "Software"), to deal
@@ -34,8 +34,6 @@
3434
*/
3535
interface AuthTokenValidator
3636
{
37-
public const CURRENT_TOKEN_FORMAT_VERSION = 'web-eid:1';
38-
3937
/**
4038
* Parses the Web eID authentication token signed by the subject.
4139
*

0 commit comments

Comments
 (0)