feat: Generalize JWKS usage

Author: joachimvh

packages/css/src/index.ts

@@ -28,6 +28,5 @@ export * from './util/fetch/Fetcher';
 export * from './util/fetch/BaseFetcher';
 export * from './util/fetch/PausableFetcher';
 export * from './util/fetch/RetryingFetcher';
-export * from './util/fetch/SignedFetcher';
 export * from './util/fetch/StatusDependant';
 export * from './util/fetch/StatusDependantServerConfigurator';

packages/css/src/util/fetch/SignedFetcher.ts

@@ -32,7 +32,6 @@
           "TypedVerifier:_verifiers_value": {
             "@id": "urn:uma:default:OidcVerifier",
             "@type": "OidcVerifier",
-            "baseUrl": { "@id": "urn:uma:variables:baseUrl" },
             "derivationStore": { "@id": "urn:uma:default:DerivationStore" }
           }
         },

packages/css/test/unit/util/fetch/SignedFetcher.test.ts

@@ -66,7 +66,6 @@
     "@types/n3": "^1.16.4",
     "asynchronous-handlers": "^1.0.2",
     "componentsjs": "^6.3.0",
-    "get-jwks": "^9.0.1",
     "global-logger-factory": "^1.0.0",
     "http-message-signatures": "^1.0.4",
     "jose": "^5.2.2",

packages/uma/config/credentials/validators/http-message.json

@@ -4,3 +4,4 @@ export const UNSECURE = 'urn:solidlab:uma:claims:formats:webid';
 export const OIDC = 'http://openid.net/specs/openid-connect-core-1_0.html#IDToken';
 export const ACCESS_TOKEN = 'urn:ietf:params:oauth:token-type:access_token';
 export const REFRESH_TOKEN = 'urn:ietf:params:oauth:token-type:refresh_token';
+export const VC_JWT = 'application/vc+jwt';

packages/uma/config/credentials/verifiers/default.json

@@ -1,6 +1,6 @@
-import buildGetJwks, { GetJwks } from 'get-jwks';
 import { getLoggerFor } from 'global-logger-factory';
-import { decodeJwt, decodeProtectedHeader, jwtVerify } from 'jose';
+import { decodeJwt, jwtVerify } from 'jose';
+import { getJwks } from '../../util/JwtUtil';
 import { ClaimSet } from '../ClaimSet';
 import { Credential } from '../Credential';
 import { JWT } from '../Formats';
@@ -12,7 +12,6 @@ import { Verifier } from './Verifier';
  */
 export class JwtVerifier implements Verifier {
   protected readonly logger = getLoggerFor(this);
-  protected jwks:GetJwks = buildGetJwks();
 
   constructor(
     private readonly allowedClaims: string[],
@@ -34,23 +33,8 @@ export class JwtVerifier implements Verifier {
         throw new Error(`JWT should contain 'iss' claim.`);
       }
 
-      const params = decodeProtectedHeader(credential.token);
-
-      if (!params.alg) {
-        throw new Error(`JWT should contain 'alg' header.`);
-      }
-
-      if (!params.kid) {
-        throw new Error(`JWT should contain 'kid' header.`);
-      }
-
-      const jwk = await this.jwks.getJwk({
-        domain: claims.iss,
-        alg: params.alg,
-        kid: params.kid,
-      });
-
-      await jwtVerify(credential.token, Object.assign(jwk, { type: 'JWK' }));
+      const jwkSet = await getJwks(claims.iss);
+      await jwtVerify(credential.token, jwkSet);
     }
 
     for (const claim of Object.keys(claims)) {

packages/uma/package.json

@@ -1,15 +1,10 @@
 import { createSolidTokenVerifier } from '@solid/access-token-verifier';
-import {
-  BadRequestHttpError,
-  ForbiddenHttpError,
-  InternalServerError,
-  joinUrl,
-  KeyValueStorage
-} from '@solid/community-server';
+import { BadRequestHttpError, ForbiddenHttpError, InternalServerError, KeyValueStorage } from '@solid/community-server';
 import { getLoggerFor } from 'global-logger-factory';
-import { createRemoteJWKSet, decodeJwt, JWTPayload, jwtVerify } from 'jose';
+import { decodeJwt, jwtVerify } from 'jose';
 import { AccessToken } from '../../tokens/AccessToken';
 import { UMA_SCOPES } from '../../ucp/util/Vocabularies';
+import { getJwks } from '../../util/JwtUtil';
 import { reType } from '../../util/ReType';
 import { Permission } from '../../views/Permission';
 import { ACCESS, CLIENTID, WEBID } from '../Claims';
@@ -21,19 +16,16 @@ import { Verifier } from './Verifier';
 /**
  * A Verifier for OIDC Tokens.
  *
- * The `allowedIssuers` list can be used to only allow tokens from these issuers.
- * Default is an empty list, which allows all issuers.
+ * To only allow tokens from certain issuers, set `verifyOptions` to { issuer: [ 'http://example.com/' ] }.
  */
 export class OidcVerifier implements Verifier {
   protected readonly logger = getLoggerFor(this);
 
   private readonly verifyToken = createSolidTokenVerifier();
 
   public constructor(
-    protected readonly baseUrl: string,
     protected readonly derivationStore: KeyValueStorage<string, string>,
-    protected readonly allowedIssuers: string[] = [],
-    protected readonly verifyOptions: Record<string, unknown> = {},
+    protected readonly verifyOptions: Record<string, unknown> = {}, // JWTVerifyOptions
   ) {}
 
   /** @inheritdoc */
@@ -46,11 +38,10 @@ export class OidcVerifier implements Verifier {
     // We first need to determine if this is a Solid OIDC token or a standard one
     const unsafeDecoded = decodeJwt(credential.token);
     const isSolidToken = (unsafeDecoded.aud === 'solid' ||
-      (Array.isArray(unsafeDecoded.aud) && unsafeDecoded.aud.includes('solid')))
+        (Array.isArray(unsafeDecoded.aud) && unsafeDecoded.aud.includes('solid')))
       && typeof unsafeDecoded.webid === 'string';
 
     try {
-      this.validateToken(unsafeDecoded);
       if (isSolidToken) {
         return await this.verifySolidToken(credential.token);
       } else {
@@ -64,18 +55,13 @@ export class OidcVerifier implements Verifier {
     }
   }
 
-  protected validateToken(payload: JWTPayload): void {
-    // TODO: disable audience check for now, need to investigate required values further
-    // if (payload.aud !== this.baseUrl && !(Array.isArray(payload.aud) && payload.aud.includes(this.baseUrl))) {
-    //   throw new BadRequestHttpError('This server is not valid audience for the token');
-    // }
-    if (!payload.iss || this.allowedIssuers.length > 0 && !this.allowedIssuers.includes(payload.iss)) {
-      throw new BadRequestHttpError('Unsupported issuer');
-    }
-  }
-
   protected async verifySolidToken(token: string): Promise<{ [WEBID]: string, [CLIENTID]?: string }> {
     const claims = await this.verifyToken(`Bearer ${token}`);
+    const issuers = this.verifyOptions.issuer;
+    const allowedIssuers = issuers !== undefined && (typeof issuers === 'string' ? [issuers] : issuers as string[]);
+    if (!claims.iss || (allowedIssuers && !allowedIssuers.includes(claims.iss))) {
+      throw new BadRequestHttpError('Unsupported issuer');
+    }
     // Depends on the spec version which field to use
     const clientId = (claims as { azp?: string }).azp ?? claims.client_id;
 
@@ -91,16 +77,7 @@ export class OidcVerifier implements Verifier {
 
   protected async verifyStandardToken(token: string, format: string, issuer: string):
     Promise<{ [WEBID]?: string, [CLIENTID]?: string, [ACCESS]?: Permission[] }> {
-    const configUrl = joinUrl(issuer, '/.well-known/openid-configuration');
-    const configResponse = await fetch(configUrl);
-    if (configResponse.status !== 200) {
-      throw new BadRequestHttpError(`Unable to access ${configUrl}`);
-    }
-    const config = await configResponse.json() as { jwks_uri?: string };
-    if (!config.jwks_uri) {
-      throw new BadRequestHttpError(`Missing jwks_uri from ${configUrl}`);
-    }
-    const jwkSet = createRemoteJWKSet(new URL(config.jwks_uri));
+    const jwkSet = await getJwks(issuer);
     const decoded = await jwtVerify(token, jwkSet, this.verifyOptions);
 
     if (format === OIDC) {

packages/uma/src/credentials/Formats.ts

@@ -87,7 +87,6 @@ export * from './util/http/server/JsonHttpErrorHandler';
 export * from './util/http/server/JsonFormHttpHandler';
 export * from './util/http/server/NodeHttpRequestResponseHandler';
 export * from './util/http/server/RoutedHttpRequestHandler';
-export * from './util/http/validate/HttpMessageValidator';
 export * from './util/http/validate/PatRequestValidator';
 export * from './util/http/validate/RequestValidator';
 
@@ -107,7 +106,7 @@ export * from './ucp/util/Vocabularies';
 // Util
 export * from './util/AggregatorUtil';
 export * from './util/ConvertUtil';
-export * from './util/HttpMessageSignatures';
+export * from './util/JwtUtil';
 export * from './util/RegistrationStore';
 export * from './util/Result';
 export * from './util/ReType';