webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-08-09 10:22:51 +03:00
Code Activity

Fixed OIDC handling when no JWKS 'use' prop exists

Browse Source 
Now assume, based on OIDC discovery spec, that keys without 'use' are
'sig' keys. Should not affect existing use-cases since existance of such
keys would have throw exceptions in prev. versions of bookstack.

For #3869
This commit is contained in:
Dan Brown
2022-11-23 11:50:59 +00:00
parent 85b7b10c01
commit e20c944350
4 changed files with 45 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
tests/Auth/OidcTest.php
View File

@@ -360,6 +360,37 @@ class OidcTest extends TestCase
$this->assertTrue(auth()->check());
}
public function test_auth_login_with_autodiscovery_with_keys_that_do_not_have_use_property()
{
// Based on reading the OIDC discovery spec:
// > This contains the signing key(s) the RP uses to validate signatures from the OP. The JWK Set MAY also
// > contain the Server's encryption key(s), which are used by RPs to encrypt requests to the Server. When
// > both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all
// > keys in the referenced JWK Set to indicate each key's intended usage.
// We can assume that keys without use are intended for signing.
$this->withAutodiscovery();
$keyArray = OidcJwtHelper::publicJwkKeyArray();
unset($keyArray['use']);
$this->mockHttpClient([
$this->getAutoDiscoveryResponse(),
new Response(200, [
'Content-Type' => 'application/json',
'Cache-Control' => 'no-cache, no-store',
'Pragma' => 'no-cache',
], json_encode([
'keys' => [
$keyArray,
],
])),
]);
$this->assertFalse(auth()->check());
$this->runLogin();
$this->assertTrue(auth()->check());
}
public function test_login_group_sync()
{
config()->set([