Uploaded image for project: 'Red Hat build of Keycloak'
  1. Red Hat build of Keycloak
  2. RHBK-2966

JWKSUtils.computeThumbprint(..) broken for ECPublicKeys [GHI#38394]

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False

      Before reporting an issue

      [x] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

      Area

      No response

      Describe the bug

      The JWKSUtils.computeThumbprint(..) does not account for ECPublicJWK keys.

      Keys generated or directly parsed as a ECPublicJWK will return incorrect thumbprints.

      Version

      26.1.4

      Regression

      [ ] The issue is a regression

      Expected behavior

      Calculating the thumbprint of a JWK does not depend on the type of its instance.

      Actual behavior

      The thumbprint depends on whether the same JWK is a JWK or a ECPublicJWK were the latter one is incorrect.

      How to Reproduce?

      
      

      String keyA = "

      {" + " \"kty\": \"EC\"," + " \"use\": \"sig\"," + " \"crv\": \"P-384\"," + " \"kid\": \"key-a\"," + " \"x\": \"KVZ5h_W0-8fXmUrxmyRpO_9vwwI7urXfyxGdxm1hpEuhPj2hhDxivnb2BhNvtC6O\"," + " \"y\": \"1J3JVw_zR3uB3biAE7fs3V_4tJy2M1JinzWj9a4je5GSoW6zgGV4bk85OcuyUAhj\"," + " \"alg\": \"ES384\"" + " }

      ";

      
      

      ECPublicJWK ecPublicKey = JsonSerialization.readValue(keyA, ECPublicJWK.class);
      JWK publicKey = JsonSerialization.readValue(keyA, JWK.class);

      
      

      assertEquals(JWKSUtils.computeThumbprint(publicKey), JWKSUtils.computeThumbprint(ecPublicKey));

      
      

      Anything else?

      Pretty sure other subclasses have similar issues.
      It would also be worthwile to check if all required members for the thumbprint are present while computing it.
      This would prevent similar issues for new subtypes.

              Unassigned Unassigned
              pvlha Pavel Vlha
              Keycloak Core Clients
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: