feat(signer): support EdDSA for the local token signer

Signed-off-by: somaz <genius5711@gmail.com>

Author: somaz94

cmd/dex/config.go

@@ -544,7 +544,7 @@ func normalizeLocalSignerConfig(c *signer.LocalConfig) error {
 		c.Algorithm = jose.RS256
 		return nil
 	}
-	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 {
+	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 || c.Algorithm == jose.EdDSA {
 		return nil
 	}
 	return fmt.Errorf("unsupported local signer algorithm %q", c.Algorithm)

server/handlers.go

@@ -1541,7 +1541,10 @@ func (s *Server) handleUserInfo(w http.ResponseWriter, r *http.Request) {
 	}
 	rawIDToken := auth[len(prefix):]
 
-	verifier := oidc.NewVerifier(s.issuerURL.String(), &signerKeySet{s.signer}, &oidc.Config{SkipClientIDCheck: true})
+	verifier := oidc.NewVerifier(s.issuerURL.String(), &signerKeySet{s.signer}, &oidc.Config{
+		SupportedSigningAlgs: supportedSigningAlgStrings(),
+		SkipClientIDCheck:    true,
+	})
 	idToken, err := verifier.Verify(ctx, rawIDToken)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to verify ID token", "err", err)

server/introspectionhandler.go

@@ -245,7 +245,10 @@ func (s *Server) introspectRefreshToken(ctx context.Context, token string) (*Int
 }
 
 func (s *Server) introspectAccessToken(ctx context.Context, token string) (*Introspection, error) {
-	verifier := oidc.NewVerifier(s.issuerURL.String(), &signerKeySet{s.signer}, &oidc.Config{SkipClientIDCheck: true})
+	verifier := oidc.NewVerifier(s.issuerURL.String(), &signerKeySet{s.signer}, &oidc.Config{
+		SupportedSigningAlgs: supportedSigningAlgStrings(),
+		SkipClientIDCheck:    true,
+	})
 	idToken, err := verifier.Verify(ctx, token)
 	if err != nil {
 		return nil, newIntrospectInactiveTokenError()

server/oauth2.go

@@ -229,6 +229,9 @@ var hashForSigAlg = map[jose.SignatureAlgorithm]func() hash.Hash{
 	jose.ES256: sha256.New,
 	jose.ES384: sha512.New384,
 	jose.ES512: sha512.New,
+	// EdDSA (Ed25519) uses SHA-512 internally, so the at_hash/c_hash is
+	// computed over SHA-512 as well.
+	jose.EdDSA: sha512.New,
 }
 
 // Compute an at_hash from a raw access token and a signature algorithm
@@ -447,7 +450,8 @@ func (s *Server) newIDToken(ctx context.Context, clientID string, claims storage
 // Returns the verified token so callers can extract Subject, Audience, etc.
 func (s *Server) validateIDTokenHint(ctx context.Context, hint string) (*oidc.IDToken, error) {
 	verifier := oidc.NewVerifier(s.issuerURL.String(), &signerKeySet{s.signer}, &oidc.Config{
-		SkipExpiryCheck: true,
+		SupportedSigningAlgs: supportedSigningAlgStrings(),
+		SkipExpiryCheck:      true,
 		// SkipClientIDCheck is set because the hint may originate from any client that
 		// Dex issued a token to — the caller does not know the expected audience in advance.
 		// The signature verification via signerKeySet already guarantees the token was
@@ -764,13 +768,33 @@ func validateConnectorID(connectors []storage.Connector, connectorID string) boo
 	return false
 }
 
+// supportedSigningAlgs lists every JWS signing algorithm a Dex signer (local or
+// Vault) can produce. Verifiers for Dex-issued tokens must allow all of them:
+// otherwise go-oidc's IDTokenVerifier.Verify defaults to RS256 only and rejects
+// ES256/EdDSA tokens before signerKeySet.VerifySignature ever runs.
+var supportedSigningAlgs = []jose.SignatureAlgorithm{
+	jose.RS256, jose.RS384, jose.RS512,
+	jose.ES256, jose.ES384, jose.ES512,
+	jose.EdDSA,
+}
+
+// supportedSigningAlgStrings returns supportedSigningAlgs as strings for use in
+// oidc.Config.SupportedSigningAlgs.
+func supportedSigningAlgStrings() []string {
+	algs := make([]string, len(supportedSigningAlgs))
+	for i, alg := range supportedSigningAlgs {
+		algs[i] = string(alg)
+	}
+	return algs
+}
+
 // signerKeySet implements the oidc.KeySet interface backed by the Dex signer
 type signerKeySet struct {
 	signer signer.Signer
 }
 
 func (s *signerKeySet) VerifySignature(ctx context.Context, jwt string) (payload []byte, err error) {
-	jws, err := jose.ParseSigned(jwt, []jose.SignatureAlgorithm{jose.RS256, jose.RS384, jose.RS512, jose.ES256, jose.ES384, jose.ES512})
+	jws, err := jose.ParseSigned(jwt, supportedSigningAlgs)
 	if err != nil {
 		return nil, err
 	}

server/oauth2_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
+	"crypto/sha512"
+	"encoding/base64"
 	"encoding/json"
 	"log/slog"
 	"net/http"
@@ -488,6 +490,16 @@ func TestAccessTokenHash(t *testing.T) {
 	}
 }
 
+func TestAccessTokenHashEdDSA(t *testing.T) {
+	atHash, err := accessTokenHash(jose.EdDSA, googleAccessToken)
+	require.NoError(t, err)
+
+	// EdDSA (Ed25519) uses SHA-512; at_hash is the base64url of the left-most half.
+	sum := sha512.Sum512([]byte(googleAccessToken))
+	want := base64.RawURLEncoding.EncodeToString(sum[:len(sum)/2])
+	require.Equal(t, want, atHash)
+}
+
 func TestValidRedirectURI(t *testing.T) {
 	tests := []struct {
 		client      storage.Client
@@ -807,6 +819,31 @@ func TestSignerKeySetWithES256LocalSigner(t *testing.T) {
 	require.Equal(t, []byte("payload"), payload)
 }
 
+func TestSignerKeySetWithEdDSALocalSigner(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	logger := slog.New(slog.DiscardHandler)
+	store := memory.New(logger)
+
+	localConfig := signer.LocalConfig{
+		KeysRotationPeriod: time.Hour.String(),
+		Algorithm:          jose.EdDSA,
+	}
+	sig, err := localConfig.Open(ctx, store, time.Hour, time.Now, logger)
+	require.NoError(t, err)
+
+	sig.Start(ctx)
+
+	jwt, err := sig.Sign(ctx, []byte("payload"))
+	require.NoError(t, err)
+
+	keySet := &signerKeySet{signer: sig}
+	payload, err := keySet.VerifySignature(ctx, jwt)
+	require.NoError(t, err)
+	require.Equal(t, []byte("payload"), payload)
+}
+
 func TestRedirectedAuthErrHandler(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -1006,6 +1043,48 @@ func TestValidateIDTokenHint(t *testing.T) {
 	})
 }
 
+// TestValidateIDTokenHintEdDSA drives the real validateIDTokenHint verifier path
+// with an EdDSA local signer. Without SupportedSigningAlgs on the oidc.Config,
+// go-oidc defaults to RS256 only and rejects the EdDSA token as "malformed jwt".
+func TestValidateIDTokenHintEdDSA(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	logger := slog.New(slog.DiscardHandler)
+	store := memory.New(logger)
+
+	localConfig := signer.LocalConfig{
+		KeysRotationPeriod: time.Hour.String(),
+		Algorithm:          jose.EdDSA,
+	}
+	sig, err := localConfig.Open(ctx, store, time.Hour, time.Now, logger)
+	require.NoError(t, err)
+	sig.Start(ctx)
+
+	issuerURL, err := url.Parse("https://issuer.example.com")
+	require.NoError(t, err)
+
+	s := &Server{
+		signer:    sig,
+		issuerURL: *issuerURL,
+		logger:    slog.Default(),
+	}
+
+	payload, err := json.Marshal(idTokenClaims{
+		Issuer:  "https://issuer.example.com",
+		Subject: "CgNmb28SA2Jhcg",
+		Expiry:  time.Now().Add(time.Hour).Unix(),
+	})
+	require.NoError(t, err)
+
+	token, err := sig.Sign(ctx, payload)
+	require.NoError(t, err)
+
+	idToken, err := s.validateIDTokenHint(ctx, token)
+	require.NoError(t, err)
+	assert.Equal(t, "CgNmb28SA2Jhcg", idToken.Subject)
+}
+
 func TestNewIDTokenUsesStoredAlgorithmUntilNextRotation(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()

server/signer/local.go

@@ -19,15 +19,15 @@ type LocalConfig struct {
 	// Algorithm defines the signing algorithm used for newly generated local keys.
 	// Changing it does not replace the current signing key immediately. The new
 	// algorithm is applied when Dex generates the next signing key during rotation.
-	// Supported values are RS256 and ES256.
+	// Supported values are RS256, ES256, and EdDSA.
 	Algorithm jose.SignatureAlgorithm `json:"algorithm"`
 }
 
 func (c *LocalConfig) signingAlgorithm() (jose.SignatureAlgorithm, error) {
 	if c.Algorithm == "" {
 		return jose.RS256, nil
 	}
-	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 {
+	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 || c.Algorithm == jose.EdDSA {
 		return c.Algorithm, nil
 	}
 	return "", fmt.Errorf("unsupported local signer algorithm %q", c.Algorithm)

server/signer/local_test.go

@@ -97,6 +97,11 @@ func TestLocalSignerAlgorithm(t *testing.T) {
 			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.ES256},
 			want: jose.ES256,
 		},
+		{
+			name: "EdDSA before first rotation",
+			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.EdDSA},
+			want: jose.EdDSA,
+		},
 	}
 
 	for _, tt := range tests {
@@ -126,6 +131,11 @@ func TestLocalSignerSignAndValidate(t *testing.T) {
 			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.ES256},
 			want: jose.ES256,
 		},
+		{
+			name: "EdDSA",
+			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.EdDSA},
+			want: jose.EdDSA,
+		},
 	}
 
 	for _, tt := range tests {

server/signer/rotation.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/ecdsa"
+	"crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
@@ -34,7 +35,7 @@ type rotationStrategy struct {
 	// Algorithm used for newly generated signing keys.
 	algorithm jose.SignatureAlgorithm
 
-	// Local signer keys can be RSA or ECDSA depending on the configured algorithm.
+	// Local signer keys can be RSA, ECDSA, or Ed25519 depending on the configured algorithm.
 	key func() (crypto.Signer, error)
 }
 
@@ -46,7 +47,7 @@ func rotationStrategyForAlgorithm(rotationFrequency, idTokenValidFor time.Durati
 		idTokenValidFor:   idTokenValidFor,
 		algorithm:         algorithm,
 	}
-	// Only RS256 and ES256 are supported for local key rotation; all other algorithms are handled by the default case.
+	// Only RS256, ES256, and EdDSA are supported for local key rotation; all other algorithms are handled by the default case.
 	switch algorithm { //nolint:exhaustive
 	case jose.RS256:
 		strategy.key = func() (crypto.Signer, error) {
@@ -56,6 +57,11 @@ func rotationStrategyForAlgorithm(rotationFrequency, idTokenValidFor time.Durati
 		strategy.key = func() (crypto.Signer, error) {
 			return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 		}
+	case jose.EdDSA:
+		strategy.key = func() (crypto.Signer, error) {
+			_, priv, err := ed25519.GenerateKey(rand.Reader)
+			return priv, err
+		}
 	default:
 		return rotationStrategy{}, fmt.Errorf("unsupported local signer algorithm %q", algorithm)
 	}

server/signer/rotation_test.go

@@ -2,12 +2,17 @@ package signer
 
 import (
 	"context"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/rsa"
 	"log/slog"
 	"sort"
 	"testing"
 	"time"
 
 	"github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/memory"
@@ -101,3 +106,43 @@ func TestKeyRotator(t *testing.T) {
 		}
 	}
 }
+
+func TestRotationStrategyForAlgorithm(t *testing.T) {
+	frequency := time.Hour
+	validFor := time.Hour
+
+	t.Run("RS256 generates an RSA key", func(t *testing.T) {
+		strategy, err := rotationStrategyForAlgorithm(frequency, validFor, jose.RS256)
+		require.NoError(t, err)
+		assert.Equal(t, jose.RS256, strategy.algorithm)
+
+		key, err := strategy.key()
+		require.NoError(t, err)
+		assert.IsType(t, &rsa.PrivateKey{}, key)
+	})
+
+	t.Run("ES256 generates an ECDSA key", func(t *testing.T) {
+		strategy, err := rotationStrategyForAlgorithm(frequency, validFor, jose.ES256)
+		require.NoError(t, err)
+		assert.Equal(t, jose.ES256, strategy.algorithm)
+
+		key, err := strategy.key()
+		require.NoError(t, err)
+		assert.IsType(t, &ecdsa.PrivateKey{}, key)
+	})
+
+	t.Run("EdDSA generates an Ed25519 key", func(t *testing.T) {
+		strategy, err := rotationStrategyForAlgorithm(frequency, validFor, jose.EdDSA)
+		require.NoError(t, err)
+		assert.Equal(t, jose.EdDSA, strategy.algorithm)
+
+		key, err := strategy.key()
+		require.NoError(t, err)
+		assert.IsType(t, ed25519.PrivateKey{}, key)
+	})
+
+	t.Run("unsupported algorithm errors", func(t *testing.T) {
+		_, err := rotationStrategyForAlgorithm(frequency, validFor, jose.PS256)
+		require.Error(t, err)
+	})
+}