37 lines
1.6 KiB
Java
37 lines
1.6 KiB
Java
|
package org.keycloak.crypto;
|
||
|
|
|
||
|
|
import org.keycloak.common.VerificationException;
|
||
|
|
import org.keycloak.jose.jws.JWSInput;
|
||
|
|
import org.keycloak.keys.loader.PublicKeyStorageManager;
|
||
|
|
import org.keycloak.models.ClientModel;
|
||
|
|
import org.keycloak.models.KeycloakSession;
|
||
|
|
|
||
|
|
public class ClientECDSASignatureVerifierContext extends AsymmetricSignatureVerifierContext {
|
||
|
|
public ClientECDSASignatureVerifierContext(KeycloakSession session, ClientModel client, JWSInput input) throws VerificationException {
|
||
|
|
super(getKey(session, client, input));
|
||
|
|
}
|
||
|
|
|
||
|
|
private static KeyWrapper getKey(KeycloakSession session, ClientModel client, JWSInput input) throws VerificationException {
|
||
|
|
KeyWrapper key = PublicKeyStorageManager.getClientPublicKeyWrapper(session, client, input);
|
||
|
|
if (key == null) {
|
||
|
|
throw new VerificationException("Key not found");
|
||
|
|
}
|
||
|
|
return key;
|
||
|
|
}
|
||
|
|
|
||
|
|
@Override
|
||
|
|
public boolean verify(byte[] data, byte[] signature) throws VerificationException {
|
||
|
|
try {
|
||
|
|
/*
|
||
|
|
Fallback for backwards compatibility of ECDSA signed tokens which were issued in previous versions.
|
||
|
|
TODO remove by https://issues.jboss.org/browse/KEYCLOAK-11911
|
||
|
|
*/
|
||
|
|
int expectedSize = ECDSASignatureProvider.ECDSA.valueOf(getAlgorithm()).getSignatureLength();
|
||
|
|
byte[] derSignature = expectedSize != signature.length && signature[0] == 0x30 ? signature : ECDSASignatureProvider.concatenatedRSToASN1DER(signature, expectedSize);
|
||
|
|
return super.verify(data, derSignature);
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new VerificationException("Signing failed", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|