starred/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-05-04 18:08:46 +03:00
Code Issues 784 Packages Projects Releases 15 Wiki Activity

feat(auth/oidc): wider key algorithm support

Browse Source
This commit is contained in:
McTom234
2025-11-23 02:58:36 +01:00
parent 5bf2d801cf
commit 743657dbac
4 changed files with 34 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
app/Access/Oidc/OidcJwtSigningKey.php
View File

@@ -2,6 +2,7 @@
namespace BookStack\Access\Oidc;
use Illuminate\Support\Facades\Log;
use phpseclib3\Crypt\Common\PublicKey;
use phpseclib3\Crypt\PublicKeyLoader;
use phpseclib3\Crypt\RSA;
@@ -63,8 +64,9 @@ class OidcJwtSigningKey
// 'alg' is optional for a JWK, but we will still attempt to validate if
// it exists otherwise presume it will be compatible.
$alg = $jwk['alg'] ?? null;
if ($jwk['kty'] !== 'RSA' || !(is_null($alg) || $alg === 'RS256')) {
throw new OidcInvalidKeyException("Only RS256 keys are currently supported. Found key using {$alg}");
$algorithm = OidcJwtSigningKeyAlgorithm::tryFrom($alg ?? OidcJwtSigningKeyAlgorithm::RS256->value);
if ($jwk['kty'] !== 'RSA' || $algorithm === null) {
throw new OidcInvalidKeyException("Only " . OidcJwtSigningKeyAlgorithm::getSupportedAlgorithms() . " keys are currently supported. Found key using {$alg}");
}
// 'use' is optional for a JWK but we assume 'sig' where no value exists since that's what
@@ -97,7 +99,16 @@ class OidcJwtSigningKey
throw new OidcInvalidKeyException('Key loaded from file path is not an RSA key as expected');
}
$this->key = $key->withPadding(RSA::SIGNATURE_PKCS1);
// apply key-algorithm depending hash
$key = match ($algorithm) {
OidcJwtSigningKeyAlgorithm::RS256 => $key->withHash('sha256'),
OidcJwtSigningKeyAlgorithm::RS512 => $key->withHash('sha512'),
};
// apply key-algorithm depending padding
$this->key = match ($algorithm) {
OidcJwtSigningKeyAlgorithm::RS256,
OidcJwtSigningKeyAlgorithm::RS512 => $key->withPadding(RSA::SIGNATURE_PKCS1),
};
}
/**

16
app/Access/Oidc/OidcJwtSigningKeyAlgorithm.php Normal file
View File

@@ -0,0 +1,16 @@
<?php
namespace BookStack\Access\Oidc;
use UnitEnum;
enum OidcJwtSigningKeyAlgorithm: string
{
case RS256 = 'RS256';
case RS512 = 'RS512';
public static function getSupportedAlgorithms(): string
{
return join(',', array_map(static fn (UnitEnum $enum) => $enum->value, self::cases()));
}
}

4
app/Access/Oidc/OidcJwtWithClaims.php
View File

@@ -119,8 +119,8 @@ class OidcJwtWithClaims implements ProvidesClaims
*/
protected function validateTokenSignature(): void
{
if ($this->header['alg'] !== 'RS256') {
throw new OidcInvalidTokenException("Only RS256 signature validation is supported. Token reports using {$this->header['alg']}");
if (OidcJwtSigningKeyAlgorithm::tryFrom($this->header['alg']) === null) {
throw new OidcInvalidTokenException("Only " . OidcJwtSigningKeyAlgorithm::getSupportedAlgorithms() . " signature validation is supported. Token reports using {$this->header['alg']}");
}
$parsedKeys = array_map(function ($key) {

4
app/Access/Oidc/OidcProviderSettings.php
View File

@@ -158,10 +158,10 @@ class OidcProviderSettings
protected function filterKeys(array $keys): array
{
return array_filter($keys, function (array $key) {
$alg = $key['alg'] ?? 'RS256';
$alg = $key['alg'] ?? OidcJwtSigningKeyAlgorithm::RS256->value;
$use = $key['use'] ?? 'sig';
return $key['kty'] === 'RSA' && $use === 'sig' && $alg === 'RS256';
return $key['kty'] === 'RSA' && $use === 'sig' && OidcJwtSigningKeyAlgorithm::tryFrom($alg) !== null;
});
}