Generate JWK for One Login public key

As part of the omniauth initializer, resolve the public key from the
private key and convert it to JWK format. Store this on the
application config so that we can retrieve it later when we need to
serve it from the JWKS endpoint.

Set the JWK kid on the omniauth configuration so it is sent with
requests to One Login.

Author: stephencdaly

config/initializers/omniauth.rb

@@ -7,6 +7,9 @@
   private_key_pem = private_key_pem.gsub('\n', "\n")
 
   private_key = OpenSSL::PKey::RSA.new(private_key_pem)
+
+  public_key_jwk = JWT::JWK.new(private_key.public_key, use: "sig")
+  Rails.application.config.x.one_login.public_key_jwk = public_key_jwk
 end
 
 Rails.application.config.middleware.use OmniAuth::Builder do
@@ -16,7 +19,7 @@
     idp_base_url: Settings.govuk_one_login.base_url,
     private_key: private_key,
     redirect_uri: "/auth/govuk_one_login/callback",
-    private_key_kid: "", # TODO: we'll need to set this when we switch to using a JWKS endpoint
+    private_key_kid: public_key_jwk&.kid,
     signing_algorithm: "ES256",
     scope: "openid email",
     ui_locales: "en cy",

spec/initializers/omniauth_spec.rb

@@ -0,0 +1,60 @@
+require "rails_helper"
+
+RSpec.describe "omniauth initializer" do
+  let(:initializer_path) { Rails.root.join("config/initializers/omniauth.rb") }
+
+  let(:one_login_settings) do
+    double(
+      private_key: private_key_setting,
+      client_id: "test-client-id",
+      base_url: "https://oidc.integration.account.gov.uk",
+    )
+  end
+
+  before do
+    allow(Settings).to receive(:govuk_one_login).and_return(one_login_settings)
+    allow(Rails.application.config.middleware).to receive(:use)
+    allow(OmniAuth::GovukOneLogin::IdpConfiguration).to receive(:new).and_return(instance_double(OmniAuth::GovukOneLogin::IdpConfiguration))
+  end
+
+  around do |example|
+    original_public_key_jwk = Rails.application.config.x.one_login.public_key_jwk
+    original_idp_configuration = Rails.application.config.x.one_login.idp_configuration
+    example.run
+  ensure
+    Rails.application.config.x.one_login.public_key_jwk = original_public_key_jwk
+    Rails.application.config.x.one_login.idp_configuration = original_idp_configuration
+  end
+
+  context "when the private key is present" do
+    let(:rsa_private_key) { OpenSSL::PKey::RSA.generate(2048) }
+    let(:private_key_setting) { Base64.encode64(rsa_private_key.to_pem) }
+
+    before { load initializer_path }
+
+    it "sets Rails.application.config.x.one_login.public_key_jwk" do
+      expect(Rails.application.config.x.one_login.public_key_jwk).to be_a(JWT::JWK::RSA)
+    end
+
+    it "sets the JWK use to 'sig'" do
+      expect(Rails.application.config.x.one_login.public_key_jwk[:use]).to eq("sig")
+    end
+
+    it "sets the JWK kid" do
+      expect(Rails.application.config.x.one_login.public_key_jwk.kid).to be_a(String)
+    end
+  end
+
+  context "when the private key is absent" do
+    let(:private_key_setting) { nil }
+
+    before do
+      Rails.application.config.x.one_login.public_key_jwk = nil
+      load initializer_path
+    end
+
+    it "does not set Rails.application.config.x.one_login.public_key_jwk" do
+      expect(Rails.application.config.x.one_login.public_key_jwk).to be_nil
+    end
+  end
+end