forked from apache/nifi
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
NIFI-14048 Added fallback to RSA for Framework Application Tokens
This closes apache#9603. - Added KeyPairGeneratorConfiguration with Security Provider detection for Ed25519 and fallback to RSA when not found - Added StandardJWSVerifierFactory supporting either EdDSA for Ed25519 or PS512 for RSA signatures - Updated KeyGenerationCommand with provided KeyPairGenerator and conditional JWS Algorithm selection Signed-off-by: Joseph Witt <[email protected]>
- Loading branch information
1 parent
bfd2092
commit e3fff91
Showing
8 changed files
with
198 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
64 changes: 64 additions & 0 deletions
64
...c/main/java/org/apache/nifi/web/security/configuration/KeyPairGeneratorConfiguration.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.nifi.web.security.configuration; | ||
|
|
||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Configuration; | ||
|
|
||
| import java.security.KeyPairGenerator; | ||
| import java.security.NoSuchAlgorithmException; | ||
| import java.security.Provider; | ||
| import java.security.Security; | ||
|
|
||
| @Configuration | ||
| public class KeyPairGeneratorConfiguration { | ||
| /** Standard Key Pair Algorithm for signing JSON Web Tokens */ | ||
| private static final String STANDARD_KEY_PAIR_ALGORITHM = "Ed25519"; | ||
|
|
||
| private static final String STANDARD_KEY_PAIR_ALGORITHM_FILTER = "KeyPairGenerator.Ed25519"; | ||
|
|
||
| /** Fallback Key Pair Algorithm when standard algorithm not supported in current Security Provider */ | ||
| private static final String FALLBACK_KEY_PAIR_ALGORITHM = "RSA"; | ||
|
|
||
| private static final Logger logger = LoggerFactory.getLogger(KeyPairGeneratorConfiguration.class); | ||
|
|
||
| /** | ||
| * JSON Web Token Key Pair Generator defaults to Ed25519 and falls back to RSA when current Security Providers do | ||
| * not support Ed25519. The fallback strategy supports security configurations that have not included Ed25519 | ||
| * as an approved algorithm. This strategy works with restricted providers such as those that have not incorporated | ||
| * algorithm approvals described in FIPS 186-5 | ||
| * | ||
| * @return Key Pair Generator for JSON Web Token signing | ||
| * @throws NoSuchAlgorithmException Thrown on failure to get Key Pair Generator for selected algorithm | ||
| */ | ||
| @Bean | ||
| public KeyPairGenerator jwtKeyPairGenerator() throws NoSuchAlgorithmException { | ||
| final String keyPairAlgorithm; | ||
|
|
||
| final Provider[] providers = Security.getProviders(STANDARD_KEY_PAIR_ALGORITHM_FILTER); | ||
| if (providers == null) { | ||
| keyPairAlgorithm = FALLBACK_KEY_PAIR_ALGORITHM; | ||
| } else { | ||
| keyPairAlgorithm = STANDARD_KEY_PAIR_ALGORITHM; | ||
| } | ||
|
|
||
| logger.info("Configured Key Pair Algorithm [{}] for JSON Web Signatures", keyPairAlgorithm); | ||
| return KeyPairGenerator.getInstance(keyPairAlgorithm); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
69 changes: 69 additions & 0 deletions
69
...st/java/org/apache/nifi/web/security/configuration/KeyPairGeneratorConfigurationTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.nifi.web.security.configuration; | ||
|
|
||
| import org.junit.jupiter.api.BeforeEach; | ||
| import org.junit.jupiter.api.Test; | ||
|
|
||
| import java.security.KeyPairGenerator; | ||
| import java.security.NoSuchAlgorithmException; | ||
| import java.security.Provider; | ||
| import java.security.Security; | ||
|
|
||
| import static org.junit.jupiter.api.Assertions.assertEquals; | ||
| import static org.junit.jupiter.api.Assertions.assertNotNull; | ||
|
|
||
| class KeyPairGeneratorConfigurationTest { | ||
| private static final String STANDARD_KEY_PAIR_ALGORITHM_FILTER = "KeyPairGenerator.Ed25519"; | ||
|
|
||
| private static final String STANDARD_KEY_PAIR_ALGORITHM = "Ed25519"; | ||
|
|
||
| private static final String FALLBACK_KEY_PAIR_ALGORITHM = "RSA"; | ||
|
|
||
| private KeyPairGeneratorConfiguration configuration; | ||
|
|
||
| @BeforeEach | ||
| void setConfiguration() { | ||
| configuration = new KeyPairGeneratorConfiguration(); | ||
| } | ||
|
|
||
| @Test | ||
| void testJwtKeyPairGenerator() throws NoSuchAlgorithmException { | ||
| final KeyPairGenerator keyPairGenerator = configuration.jwtKeyPairGenerator(); | ||
|
|
||
| final String algorithm = keyPairGenerator.getAlgorithm(); | ||
| assertEquals(STANDARD_KEY_PAIR_ALGORITHM, algorithm); | ||
| } | ||
|
|
||
| @Test | ||
| void testJwtKeyPairGeneratorFallbackAlgorithm() throws NoSuchAlgorithmException { | ||
| final Provider[] providers = Security.getProviders(STANDARD_KEY_PAIR_ALGORITHM_FILTER); | ||
| assertNotNull(providers); | ||
|
|
||
| final Provider provider = providers[0]; | ||
| try { | ||
| Security.removeProvider(provider.getName()); | ||
|
|
||
| final KeyPairGenerator keyPairGenerator = configuration.jwtKeyPairGenerator(); | ||
|
|
||
| final String algorithm = keyPairGenerator.getAlgorithm(); | ||
| assertEquals(FALLBACK_KEY_PAIR_ALGORITHM, algorithm); | ||
| } finally { | ||
| Security.addProvider(provider); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters