def validSignature(self, jwt): print "Passport-social. validSignature. Checking JWT token signature" valid = False # security vulnerability - we need to validate sigAlgorithm = jwt.getHeader().getAlgorithm().getName() if ( sigAlgorithm != "RS512" ): return False try: appConfiguration = AppConfiguration() appConfiguration.setWebKeysStorage(WebKeyStorage.KEYSTORE) appConfiguration.setKeyStoreFile(self.keyStoreFile) appConfiguration.setKeyStoreSecret(self.keyStorePassword) appConfiguration.setKeyRegenerationEnabled(False) cryptoProvider = CryptoProviderFactory.getCryptoProvider(appConfiguration) valid = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), jwt.getHeader().getKeyId(), None, None, jwt.getHeader().getAlgorithm()) except: print "Exception: ", sys.exc_info()[1] print "Passport-social. validSignature. Validation result was %s" % valid return valid
def validSignature(self, jwt): print "Passport. validSignature. Checking JWT token signature" valid = False try: appConfiguration = AppConfiguration() appConfiguration.setWebKeysStorage(WebKeyStorage.KEYSTORE) appConfiguration.setKeyStoreFile(self.keyStoreFile) appConfiguration.setKeyStoreSecret(self.keyStorePassword) appConfiguration.setKeyRegenerationEnabled(False) cryptoProvider = CryptoProviderFactory.getCryptoProvider( appConfiguration) alg_string = str(jwt.getHeader().getAlgorithm()) signature_string = str(jwt.getEncodedSignature()) if alg_string == "none" or alg_string == "None" or alg_string == "NoNe" or alg_string == "nONE" or alg_string == "NONE" or alg_string == "NonE" or alg_string == "nOnE": # blocks none attack print "WARNING: JWT Signature algorithm is none" valid = False elif alg_string != "RS512": # blocks anything that's not RS512 print "WARNING: JWT Signature algorithm is NOT RS512" valid = False elif signature_string == "": # blocks empty signature string print "WARNING: JWT Signature not sent" valid = False else: # class extends AbstractCryptoProvider ''' on version 4.2 .getAlgorithm() method was renamed to .getSignatureAlgorithm() for older versions: valid = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), jwt.getHeader().getKeyId(), None, None, jwt.getHeader().getAlgorithm()) ''' # working on 4.2: valid = cryptoProvider.verifySignature( jwt.getSigningInput(), jwt.getEncodedSignature(), jwt.getHeader().getKeyId(), None, None, jwt.getHeader().getSignatureAlgorithm()) except: print "Exception: ", sys.exc_info()[1] print "Passport. validSignature. Validation result was %s" % valid return valid
def init(self, configurationAttributes, scriptName): print("Passport. init called from " + scriptName) self.telemetryClient = TelemetryClient() try: # Instantiate a Crypto Provider to verify token signatures self.keyStoreFile = configurationAttributes.get( "key_store_file").getValue2() self.keyStorePassword = configurationAttributes.get( "key_store_password").getValue2() appConfiguration = AppConfiguration() appConfiguration.setWebKeysStorage(WebKeyStorage.KEYSTORE) appConfiguration.setKeyStoreFile(self.keyStoreFile) appConfiguration.setKeyStoreSecret(self.keyStorePassword) appConfiguration.setRejectJwtWithNoneAlg(True) appConfiguration.setKeyRegenerationEnabled(False) self.cryptoProvider = CryptoProviderFactory.getCryptoProvider( appConfiguration) # Load the passport config with open('/etc/gluu/conf/passport-config.json', 'r') as configFile: self.passportConfig = json.load(configFile) if StringHelper.isEmpty( self.passportConfig["keyAlg"]) or StringHelper.isEmpty( self.passportConfig["keyId"]): print( "Passport. init for %s. Failed to read key information from passport-config" % scriptName) return False # Load all provider configurations self.registeredProviders = self.parseProviders() except: print("Passport. init for %s. Initialization failed:" % scriptName) print(sys.exc_info()) return False print("Passport. init for %s. Initialization success" % scriptName) return True