Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update OIDC id_token_signing_alg_values_supported for wider algo support #111

Merged
merged 3 commits into from
Sep 16, 2024
Merged

Update OIDC id_token_signing_alg_values_supported for wider algo support #111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1897cc3
Update OIDC id_token_signing_alg_values_supported for wider algo support
jinnatar Sep 9, 2024
01c22cf
Add tests for non-RS256 sign-alg & failing a none-only sign-alg
jinnatar Sep 9, 2024
c06902e
Fix test logic for correct assert and tangential miss from existing test
jinnatar Sep 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions src/idpyoidc/message/oidc/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -942,8 +942,14 @@ def verify(self, **kwargs):
"token_endpoint_auth_signing_alg_values_supported"
)

if "RS256" not in self["id_token_signing_alg_values_supported"]:
raise ValueError("RS256 missing from id_token_signing_alg_values_supported")
# Check that any alg that is not "none" is supported.
# While OpenID Connect Core 1.0 says RS256 MUST be supported,
# reality has moved on and more modern alg values may be required.
if not any(i.lower() != "none" for i in self["id_token_signing_alg_values_supported"]):
raise ValueError(
"Secure signing algorithm (for example RS256 or ES256) missing from id_token_signing_alg_values_supported: %s"
% self["id_token_signing_alg_values_supported"]
)

if not parts.query and not parts.fragment:
pass
Expand Down
29 changes: 29 additions & 0 deletions tests/test_06_oidc.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -470,6 +470,7 @@ def test_example_response(self):
[
"issuer",
"authorization_endpoint",
"token_endpoint",
"jwks_uri",
"response_types_supported",
"subject_types_supported",
Expand All @@ -480,6 +481,7 @@ def test_required_parameters(self, required_param):
provider_config = {
"issuer": "https://server.example.com",
"authorization_endpoint": "https://server.example.com/connect/authorize",
"token_endpoint": "https://server.example.com/connect/token",
"jwks_uri": "https://server.example.com/jwks.json",
"response_types_supported": ["code", "code id_token", "id_token", "token id_token"],
"subject_types_supported": ["public", "pairwise"],
Expand Down Expand Up @@ -516,6 +518,33 @@ def test_token_endpoint_is_required_for_other_than_implicit_flow_only(self):
with pytest.raises(MissingRequiredAttribute):
ProviderConfigurationResponse(**provider_config).verify()

def test_required_parameters_without_rs256(self):
provider_config = {
"issuer": "https://server.example.com",
"authorization_endpoint": "https://server.example.com/connect/authorize",
"token_endpoint": "https://server.example.com/connect/token",
"jwks_uri": "https://server.example.com/jwks.json",
"response_types_supported": ["code", "code id_token", "id_token", "token id_token"],
"subject_types_supported": ["public", "pairwise"],
"id_token_signing_alg_values_supported": ["none", "ES256", "HS256"],
}

assert ProviderConfigurationResponse(**provider_config).verify()

def test_required_parameters_only_none_signing_alg(self):
provider_config = {
"issuer": "https://server.example.com",
"authorization_endpoint": "https://server.example.com/connect/authorize",
"token_endpoint": "https://server.example.com/connect/token",
"jwks_uri": "https://server.example.com/jwks.json",
"response_types_supported": ["code", "code id_token", "id_token", "token id_token"],
"subject_types_supported": ["public", "pairwise"],
"id_token_signing_alg_values_supported": ["none"],
}

with pytest.raises(ValueError):
ProviderConfigurationResponse(**provider_config).verify()


class TestRegistrationRequest(object):
def test_deserialize(self):
Expand Down
Loading