feat(signer): support EdDSA for the local token signer

Signed-off-by: somaz <genius5711@gmail.com>

Author: somaz94

cmd/dex/config.go

@@ -544,7 +544,7 @@ func normalizeLocalSignerConfig(c *signer.LocalConfig) error {
 		c.Algorithm = jose.RS256
 		return nil
 	}
-	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 {
+	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 || c.Algorithm == jose.EdDSA {
 		return nil
 	}
 	return fmt.Errorf("unsupported local signer algorithm %q", c.Algorithm)

server/introspectionhandler.go

@@ -151,6 +151,12 @@ func (s *Server) guessTokenType(ctx context.Context, token string) (TokenTypeEnu
 		SkipExpiryCheck:   true,
 		SkipIssuerCheck:   true,
 
+		// go-oidc validates the token's alg against SupportedSigningAlgs before
+		// honoring InsecureSkipSignatureCheck; without this it defaults to RS256
+		// only and rejects ES256/EdDSA access tokens, mis-classifying them as
+		// refresh tokens.
+		SupportedSigningAlgs: supportedSigningAlgStrings(),
+
 		// We skip signature checks to avoid database calls;
 		InsecureSkipSignatureCheck: true,
 	}
@@ -245,7 +251,10 @@ func (s *Server) introspectRefreshToken(ctx context.Context, token string) (*Int
 }
 
 func (s *Server) introspectAccessToken(ctx context.Context, token string) (*Introspection, error) {
-	verifier := oidc.NewVerifier(s.issuerURL.String(), &signerKeySet{s.signer}, &oidc.Config{SkipClientIDCheck: true})
+	verifier := oidc.NewVerifier(s.issuerURL.String(), &signerKeySet{s.signer}, &oidc.Config{
+		SupportedSigningAlgs: supportedSigningAlgStrings(),
+		SkipClientIDCheck:    true,
+	})
 	idToken, err := verifier.Verify(ctx, token)
 	if err != nil {
 		return nil, newIntrospectInactiveTokenError()

server/introspectionhandler_test.go

@@ -12,10 +12,13 @@ import (
 	"testing"
 	"time"
 
+	"github.com/go-jose/go-jose/v4"
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/signer"
 	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
 )
 
 func toJSON(a interface{}) string {
@@ -362,6 +365,75 @@ func TestHandleIntrospect(t *testing.T) {
 	}
 }
 
+// TestHandleIntrospectEdDSA drives the full introspection endpoint with an
+// EdDSA-signed access token. It is a regression test for guessTokenType: without
+// SupportedSigningAlgs on its verifier config, go-oidc defaults to RS256 only and
+// rejects the EdDSA token, so the access token is mis-classified as a refresh
+// token and introspection returns active: false.
+func TestHandleIntrospectEdDSA(t *testing.T) {
+	t0 := time.Now()
+
+	ctx := t.Context()
+
+	now := func() time.Time { return t0 }
+
+	logger := newLogger(t)
+
+	refreshTokenPolicy, err := NewRefreshTokenPolicy(logger, false, "", "24h", "")
+	if err != nil {
+		t.Fatalf("failed to prepare rotation policy: %v", err)
+	}
+	refreshTokenPolicy.now = now
+
+	localConfig := signer.LocalConfig{
+		KeysRotationPeriod: time.Hour.String(),
+		Algorithm:          jose.EdDSA,
+	}
+	eddsaSigner, err := localConfig.Open(ctx, memory.New(logger), time.Hour, now, logger)
+	require.NoError(t, err)
+
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.Issuer += "/non-root-path"
+		c.RefreshTokenPolicy = refreshTokenPolicy
+		c.Now = now
+		c.Signer = eddsaSigner
+	})
+	defer httpServer.Close()
+
+	mockTestStorage(t, s.storage)
+
+	activeAccessToken, expiry, err := s.newIDToken(ctx, "test", storage.Claims{
+		UserID:        "1",
+		Username:      "jane",
+		Email:         "jane.doe@example.com",
+		EmailVerified: true,
+		Groups:        []string{"a", "b"},
+	}, []string{"openid", "email", "profile", "groups"}, "foo", "", "", "test", time.Time{})
+	require.NoError(t, err)
+
+	// guessTokenType must recognize the EdDSA access token as an access token.
+	tokenType, err := s.guessTokenType(ctx, activeAccessToken)
+	require.NoError(t, err)
+	require.Equal(t, AccessToken, tokenType)
+
+	// The full /token/introspect endpoint must report the EdDSA access token as active.
+	data := url.Values{}
+	data.Set("token", activeAccessToken)
+
+	u, err := url.Parse(s.issuerURL.String())
+	require.NoError(t, err)
+	u.Path = path.Join(u.Path, "token", "introspect")
+
+	req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(data.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	rr := httptest.NewRecorder()
+	s.ServeHTTP(rr, req)
+
+	require.Equal(t, 200, rr.Code)
+	require.JSONEq(t, toJSON(getIntrospectionValue(s.issuerURL, t0, expiry, "access_token")), rr.Body.String())
+}
+
 func TestIntrospectErrHelper(t *testing.T) {
 	t0 := time.Now()
 

server/oauth2.go

@@ -229,6 +229,9 @@ var hashForSigAlg = map[jose.SignatureAlgorithm]func() hash.Hash{
 	jose.ES256: sha256.New,
 	jose.ES384: sha512.New384,
 	jose.ES512: sha512.New,
+	// EdDSA (Ed25519) uses SHA-512 internally, so the at_hash/c_hash is
+	// computed over SHA-512 as well.
+	jose.EdDSA: sha512.New,
 }
 
 // Compute an at_hash from a raw access token and a signature algorithm
@@ -447,7 +450,8 @@ func (s *Server) newIDToken(ctx context.Context, clientID string, claims storage
 // Returns the verified token so callers can extract Subject, Audience, etc.
 func (s *Server) validateIDTokenHint(ctx context.Context, hint string) (*oidc.IDToken, error) {
 	verifier := oidc.NewVerifier(s.issuerURL.String(), &signerKeySet{s.signer}, &oidc.Config{
-		SkipExpiryCheck: true,
+		SupportedSigningAlgs: supportedSigningAlgStrings(),
+		SkipExpiryCheck:      true,
 		// SkipClientIDCheck is set because the hint may originate from any client that
 		// Dex issued a token to — the caller does not know the expected audience in advance.
 		// The signature verification via signerKeySet already guarantees the token was
@@ -763,13 +767,33 @@ func validateConnectorID(connectors []storage.Connector, connectorID string) boo
 	return false
 }
 
+// supportedSigningAlgs lists every JWS signing algorithm a Dex signer (local or
+// Vault) can produce. Verifiers for Dex-issued tokens must allow all of them:
+// otherwise go-oidc's IDTokenVerifier.Verify defaults to RS256 only and rejects
+// ES256/EdDSA tokens before signerKeySet.VerifySignature ever runs.
+var supportedSigningAlgs = []jose.SignatureAlgorithm{
+	jose.RS256, jose.RS384, jose.RS512,
+	jose.ES256, jose.ES384, jose.ES512,
+	jose.EdDSA,
+}
+
+// supportedSigningAlgStrings returns supportedSigningAlgs as strings for use in
+// oidc.Config.SupportedSigningAlgs.
+func supportedSigningAlgStrings() []string {
+	algs := make([]string, len(supportedSigningAlgs))
+	for i, alg := range supportedSigningAlgs {
+		algs[i] = string(alg)
+	}
+	return algs
+}
+
 // signerKeySet implements the oidc.KeySet interface backed by the Dex signer
 type signerKeySet struct {
 	signer signer.Signer
 }
 
 func (s *signerKeySet) VerifySignature(ctx context.Context, jwt string) (payload []byte, err error) {
-	jws, err := jose.ParseSigned(jwt, []jose.SignatureAlgorithm{jose.RS256, jose.RS384, jose.RS512, jose.ES256, jose.ES384, jose.ES512})
+	jws, err := jose.ParseSigned(jwt, supportedSigningAlgs)
 	if err != nil {
 		return nil, err
 	}

server/oauth2_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
+	"crypto/sha512"
+	"encoding/base64"
 	"encoding/json"
 	"log/slog"
 	"net/http"
@@ -488,6 +490,16 @@ func TestAccessTokenHash(t *testing.T) {
 	}
 }
 
+func TestAccessTokenHashEdDSA(t *testing.T) {
+	atHash, err := accessTokenHash(jose.EdDSA, googleAccessToken)
+	require.NoError(t, err)
+
+	// EdDSA (Ed25519) uses SHA-512; at_hash is the base64url of the left-most half.
+	sum := sha512.Sum512([]byte(googleAccessToken))
+	want := base64.RawURLEncoding.EncodeToString(sum[:len(sum)/2])
+	require.Equal(t, want, atHash)
+}
+
 func TestValidRedirectURI(t *testing.T) {
 	tests := []struct {
 		client      storage.Client
@@ -807,6 +819,31 @@ func TestSignerKeySetWithES256LocalSigner(t *testing.T) {
 	require.Equal(t, []byte("payload"), payload)
 }
 
+func TestSignerKeySetWithEdDSALocalSigner(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	logger := slog.New(slog.DiscardHandler)
+	store := memory.New(logger)
+
+	localConfig := signer.LocalConfig{
+		KeysRotationPeriod: time.Hour.String(),
+		Algorithm:          jose.EdDSA,
+	}
+	sig, err := localConfig.Open(ctx, store, time.Hour, time.Now, logger)
+	require.NoError(t, err)
+
+	sig.Start(ctx)
+
+	jwt, err := sig.Sign(ctx, []byte("payload"))
+	require.NoError(t, err)
+
+	keySet := &signerKeySet{signer: sig}
+	payload, err := keySet.VerifySignature(ctx, jwt)
+	require.NoError(t, err)
+	require.Equal(t, []byte("payload"), payload)
+}
+
 func TestRedirectedAuthErrHandler(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -1006,6 +1043,48 @@ func TestValidateIDTokenHint(t *testing.T) {
 	})
 }
 
+// TestValidateIDTokenHintEdDSA drives the real validateIDTokenHint verifier path
+// with an EdDSA local signer. Without SupportedSigningAlgs on the oidc.Config,
+// go-oidc defaults to RS256 only and rejects the EdDSA token as "malformed jwt".
+func TestValidateIDTokenHintEdDSA(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	logger := slog.New(slog.DiscardHandler)
+	store := memory.New(logger)
+
+	localConfig := signer.LocalConfig{
+		KeysRotationPeriod: time.Hour.String(),
+		Algorithm:          jose.EdDSA,
+	}
+	sig, err := localConfig.Open(ctx, store, time.Hour, time.Now, logger)
+	require.NoError(t, err)
+	sig.Start(ctx)
+
+	issuerURL, err := url.Parse("https://issuer.example.com")
+	require.NoError(t, err)
+
+	s := &Server{
+		signer:    sig,
+		issuerURL: *issuerURL,
+		logger:    slog.Default(),
+	}
+
+	payload, err := json.Marshal(idTokenClaims{
+		Issuer:  "https://issuer.example.com",
+		Subject: "CgNmb28SA2Jhcg",
+		Expiry:  time.Now().Add(time.Hour).Unix(),
+	})
+	require.NoError(t, err)
+
+	token, err := sig.Sign(ctx, payload)
+	require.NoError(t, err)
+
+	idToken, err := s.validateIDTokenHint(ctx, token)
+	require.NoError(t, err)
+	assert.Equal(t, "CgNmb28SA2Jhcg", idToken.Subject)
+}
+
 func TestNewIDTokenUsesStoredAlgorithmUntilNextRotation(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()

server/signer/local.go

@@ -19,15 +19,15 @@ type LocalConfig struct {
 	// Algorithm defines the signing algorithm used for newly generated local keys.
 	// Changing it does not replace the current signing key immediately. The new
 	// algorithm is applied when Dex generates the next signing key during rotation.
-	// Supported values are RS256 and ES256.
+	// Supported values are RS256, ES256, and EdDSA.
 	Algorithm jose.SignatureAlgorithm `json:"algorithm"`
 }
 
 func (c *LocalConfig) signingAlgorithm() (jose.SignatureAlgorithm, error) {
 	if c.Algorithm == "" {
 		return jose.RS256, nil
 	}
-	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 {
+	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 || c.Algorithm == jose.EdDSA {
 		return c.Algorithm, nil
 	}
 	return "", fmt.Errorf("unsupported local signer algorithm %q", c.Algorithm)

server/signer/local_test.go

@@ -97,6 +97,11 @@ func TestLocalSignerAlgorithm(t *testing.T) {
 			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.ES256},
 			want: jose.ES256,
 		},
+		{
+			name: "EdDSA before first rotation",
+			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.EdDSA},
+			want: jose.EdDSA,
+		},
 	}
 
 	for _, tt := range tests {
@@ -126,6 +131,11 @@ func TestLocalSignerSignAndValidate(t *testing.T) {
 			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.ES256},
 			want: jose.ES256,
 		},
+		{
+			name: "EdDSA",
+			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.EdDSA},
+			want: jose.EdDSA,
+		},
 	}
 
 	for _, tt := range tests {

server/signer/rotation.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/ecdsa"
+	"crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
@@ -34,7 +35,7 @@ type rotationStrategy struct {
 	// Algorithm used for newly generated signing keys.
 	algorithm jose.SignatureAlgorithm
 
-	// Local signer keys can be RSA or ECDSA depending on the configured algorithm.
+	// Local signer keys can be RSA, ECDSA, or Ed25519 depending on the configured algorithm.
 	key func() (crypto.Signer, error)
 }
 
@@ -46,7 +47,7 @@ func rotationStrategyForAlgorithm(rotationFrequency, idTokenValidFor time.Durati
 		idTokenValidFor:   idTokenValidFor,
 		algorithm:         algorithm,
 	}
-	// Only RS256 and ES256 are supported for local key rotation; all other algorithms are handled by the default case.
+	// Only RS256, ES256, and EdDSA are supported for local key rotation; all other algorithms are handled by the default case.
 	switch algorithm { //nolint:exhaustive
 	case jose.RS256:
 		strategy.key = func() (crypto.Signer, error) {
@@ -56,6 +57,11 @@ func rotationStrategyForAlgorithm(rotationFrequency, idTokenValidFor time.Durati
 		strategy.key = func() (crypto.Signer, error) {
 			return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 		}
+	case jose.EdDSA:
+		strategy.key = func() (crypto.Signer, error) {
+			_, priv, err := ed25519.GenerateKey(rand.Reader)
+			return priv, err
+		}
 	default:
 		return rotationStrategy{}, fmt.Errorf("unsupported local signer algorithm %q", algorithm)
 	}