Merge pull request mitreid-connect#1355 from ocadotechnology/jwt_fix

Throwing exception on all other JWT types than SignedJWT

Author: jricher

openid-connect-server/src/main/java/org/mitre/openid/connect/assertion/JWTBearerAuthenticationProvider.java

@@ -91,57 +91,60 @@ public Authentication authenticate(Authentication authentication) throws Authent
 			JWT jwt = jwtAuth.getJwt();
 			JWTClaimsSet jwtClaims = jwt.getJWTClaimsSet();
 
+			if (!(jwt instanceof SignedJWT)) {
+				throw new AuthenticationServiceException("Unsupported JWT type: " + jwt.getClass().getName());
+			}
+
 			// check the signature with nimbus
-			if (jwt instanceof SignedJWT) {
-				SignedJWT jws = (SignedJWT)jwt;
+			SignedJWT jws = (SignedJWT) jwt;
+
+			JWSAlgorithm alg = jws.getHeader().getAlgorithm();
+
+			if (client.getTokenEndpointAuthSigningAlg() != null &&
+					!client.getTokenEndpointAuthSigningAlg().equals(alg)) {
+				throw new AuthenticationServiceException("Client's registered token endpoint signing algorithm (" + client.getTokenEndpointAuthSigningAlg()
+						+ ") does not match token's actual algorithm (" + alg.getName() + ")");
+			}
+
+			if (client.getTokenEndpointAuthMethod() == null ||
+					client.getTokenEndpointAuthMethod().equals(AuthMethod.NONE) ||
+					client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_BASIC) ||
+					client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_POST)) {
+
+				// this client doesn't support this type of authentication
+				throw new AuthenticationServiceException("Client does not support this authentication method.");
+
+			} else if ((client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY) &&
+					(alg.equals(JWSAlgorithm.RS256)
+							|| alg.equals(JWSAlgorithm.RS384)
+							|| alg.equals(JWSAlgorithm.RS512)
+							|| alg.equals(JWSAlgorithm.ES256)
+							|| alg.equals(JWSAlgorithm.ES384)
+							|| alg.equals(JWSAlgorithm.ES512)
+							|| alg.equals(JWSAlgorithm.PS256)
+							|| alg.equals(JWSAlgorithm.PS384)
+							|| alg.equals(JWSAlgorithm.PS512)))
+					|| (client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_JWT) &&
+					(alg.equals(JWSAlgorithm.HS256)
+							|| alg.equals(JWSAlgorithm.HS384)
+							|| alg.equals(JWSAlgorithm.HS512)))) {
+
+				// double-check the method is asymmetrical if we're in HEART mode
+				if (config.isHeartMode() && !client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY)) {
+					throw new AuthenticationServiceException("[HEART mode] Invalid authentication method");
+				}
 
-				JWSAlgorithm alg = jws.getHeader().getAlgorithm();
+				JWTSigningAndValidationService validator = validators.getValidator(client, alg);
 
-				if (client.getTokenEndpointAuthSigningAlg() != null &&
-						!client.getTokenEndpointAuthSigningAlg().equals(alg)) {
-					throw new InvalidClientException("Client's registered request object signing algorithm (" + client.getRequestObjectSigningAlg() + ") does not match request object's actual algorithm (" + alg.getName() + ")");
+				if (validator == null) {
+					throw new AuthenticationServiceException("Unable to create signature validator for client " + client + " and algorithm " + alg);
 				}
 
-				if (client.getTokenEndpointAuthMethod() == null ||
-						client.getTokenEndpointAuthMethod().equals(AuthMethod.NONE) ||
-						client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_BASIC) ||
-						client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_POST)) {
-
-					// this client doesn't support this type of authentication
-					throw new AuthenticationServiceException("Client does not support this authentication method.");
-
-				} else if ((client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY) &&
-						(alg.equals(JWSAlgorithm.RS256)
-								|| alg.equals(JWSAlgorithm.RS384)
-								|| alg.equals(JWSAlgorithm.RS512)
-								|| alg.equals(JWSAlgorithm.ES256)
-								|| alg.equals(JWSAlgorithm.ES384)
-								|| alg.equals(JWSAlgorithm.ES512)
-								|| alg.equals(JWSAlgorithm.PS256)
-								|| alg.equals(JWSAlgorithm.PS384)
-								|| alg.equals(JWSAlgorithm.PS512)))
-						|| (client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_JWT) &&
-								(alg.equals(JWSAlgorithm.HS256)
-										|| alg.equals(JWSAlgorithm.HS384)
-										|| alg.equals(JWSAlgorithm.HS512)))) {
-
-					// double-check the method is asymmetrical if we're in HEART mode
-					if (config.isHeartMode() && !client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY)) {
-						throw new AuthenticationServiceException("[HEART mode] Invalid authentication method");
-					}
-
-					JWTSigningAndValidationService validator = validators.getValidator(client, alg);
-
-					if (validator == null) {
-						throw new AuthenticationServiceException("Unable to create signature validator for client " + client + " and algorithm " + alg);
-					}
-
-					if (!validator.validateSignature(jws)) {
-						throw new AuthenticationServiceException("Signature did not validate for presented JWT authentication.");
-					}
-				} else {
-					throw new AuthenticationServiceException("Unable to create signature validator for method " + client.getTokenEndpointAuthMethod() + " and algorithm " + alg);
+				if (!validator.validateSignature(jws)) {
+					throw new AuthenticationServiceException("Signature did not validate for presented JWT authentication.");
 				}
+			} else {
+				throw new AuthenticationServiceException("Unable to create signature validator for method " + client.getTokenEndpointAuthMethod() + " and algorithm " + alg);
 			}
 
 			// check the issuer