Refactor JWKS endpoint to support mixed RSA and EdDSA keystores#3058
Open
udeepa15 wants to merge 2 commits intowso2-extensions:masterfrom
Open
Refactor JWKS endpoint to support mixed RSA and EdDSA keystores#3058udeepa15 wants to merge 2 commits intowso2-extensions:masterfrom
udeepa15 wants to merge 2 commits intowso2-extensions:masterfrom
Conversation
Replace raw JSONArray usage with a typed List<Map<String,Object>> and switch from returning RSAKey.Builder to built JWK objects. Skip non-RSA public keys (EdDSA/EC are served separately), centralize thumbprint logic into addThumbprints(), and use OAuth2Util.JWT_X5T_ENABLED for x5t config checks. Adjust deprecated old-KID creation to the new collection type. Update tests: add a test JwksEndpoint class and modify imports/usages to reflect the JWT_X5T_ENABLED config constant.
Delete JwksEndpoint.java from components/org.wso2.carbon.identity.oauth.endpoint/src/test/java/org/wso2/carbon/identity/oauth/endpoint/jwks. This removes the JWKS endpoint test implementation (previously a ~308-line test class) from the oauth endpoint module.
![wso2-engineering[bot]](https://avatars.githubusercontent.com/in/1856828?s=60&v=4){kind=small}
Comment on lines
+105
to
106
| List<Map<String, Object>> jwksArray = new ArrayList<>(); | ||
| JSONObject jwksJson = new JSONObject(); |
Contributor
There was a problem hiding this comment.
Log Improvement Suggestion No: 1
Suggested change
| List<Map<String, Object>> jwksArray = new ArrayList<>(); | |
| JSONObject jwksJson = new JSONObject(); | |
| JSONObject jwksJson = new JSONObject(); | |
| OAuthServerConfiguration config = OAuthServerConfiguration.getInstance(); | |
| log.info("Building JWKS response for tenant: " + getTenantDomain()); |
Comment on lines
+153
to
+163
| PublicKey publicKey = certificate.getPublicKey(); | ||
|
|
||
| // Only handle RSA keys - EdDSA and EC keys are served via separate endpoint | ||
| if (!(publicKey instanceof RSAPublicKey)) { | ||
| if (log.isDebugEnabled()) { | ||
| log.debug("Skipping non-RSA key for alias: " + alias + | ||
| ", algorithm: " + publicKey.getAlgorithm() + | ||
| " (EdDSA/EC keys are served via separate endpoint)"); | ||
| } | ||
| return null; | ||
| } |
Contributor
There was a problem hiding this comment.
Log Improvement Suggestion No: 2
Suggested change
| PublicKey publicKey = certificate.getPublicKey(); | |
| // Only handle RSA keys - EdDSA and EC keys are served via separate endpoint | |
| if (!(publicKey instanceof RSAPublicKey)) { | |
| if (log.isDebugEnabled()) { | |
| log.debug("Skipping non-RSA key for alias: " + alias + | |
| ", algorithm: " + publicKey.getAlgorithm() + | |
| " (EdDSA/EC keys are served via separate endpoint)"); | |
| } | |
| return null; | |
| } | |
| PublicKey publicKey = certificate.getPublicKey(); | |
| // Only handle RSA keys - EdDSA and EC keys are served via separate endpoint | |
| if (!(publicKey instanceof RSAPublicKey)) { | |
| if (log.isDebugEnabled()) { | |
| log.debug("Skipping non-RSA key for alias: " + alias + | |
| ", algorithm: " + publicKey.getAlgorithm() + | |
| " (EdDSA/EC keys are served via separate endpoint)"); | |
| } | |
| return null; | |
| } | |
| if (log.isDebugEnabled()) { | |
| log.debug("Creating JWK for RSA certificate with alias: " + alias + ", algorithm: " + algorithm); | |
| } |
Contributor
There was a problem hiding this comment.
AI Agent Log Improvement Checklist
- The log-related comments and suggestions in this review were generated by an AI tool to assist with identifying potential improvements. Purpose of reviewing the code for log improvements is to improve the troubleshooting capabilities of our products.
- Please make sure to manually review and validate all suggestions before applying any changes. Not every code suggestion would make sense or add value to our purpose. Therefore, you have the freedom to decide which of the suggestions are helpful.
✅ Before merging this pull request:
- Review all AI-generated comments for accuracy and relevance.
- Complete and verify the table below. We need your feedback to measure the accuracy of these suggestions and the value they add. If you are rejecting a certain code suggestion, please mention the reason briefly in the suggestion for us to capture it.
| Comment | Accepted (Y/N) | Reason |
|---|---|---|
| #### Log Improvement Suggestion No: 1 | ||
| #### Log Improvement Suggestion No: 2 |
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes in this pull request
When the keystore holds both RSA and EdDSA (Ed25519/Ed448) key pairs the old code cast every public key unconditionally to RSAPublicKey, which would throw a ClassCastException at runtime for EdDSA entries. These commits make the JWKS endpoint safe to operate with a mixed-algorithm keystore.
error
1. Key Type Guard (
JwksEndpoint.java)instanceof RSAPublicKeycheck before castingnulland are skipped"Skipping non-RSA key for alias: X, algorithm: EdDSA (EdDSA/EC keys are served via separate endpoint)"2. Type Safety Improvements
net.minidev.json.JSONArray→List<Map<String, Object>>for type safetyRSAKey.Builder→JWK(return fully built objects)3. Code Quality Refactoring
addThumbprints()methodjwk→builder)4. Configuration Consolidation
JwksEndpoint.JWKS_IS_X5T_REQUIREDconstantOAuth2Util.JWT_X5T_ENABLED5. Test Cleanup
JwksEndpointTest.javato use centralized constant###JWKS Payload
-before the changes
-after the changes
Developer Checklist (Mandatory)
product-isissue to track any behavioral change or migration impact.Checklist (for reviewing)
General
Functionality
Code
Tests
Security
Documentation