IdTokenVerifier::getIssuerJWKFromKid() - Code Metrics - Inspection of "Handle issuer jwks update on kid key missing" - thomasvargiu/php-openid-client - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( c8bc96...3cc4a7 )

by Thomas Mauro

created 2019-07-10 15:12 UTC

IdTokenVerifier::getIssuerJWKFromKid() A

↳ Parent: IdTokenVerifier

Complexity

Conditions	3
Paths	4

Size

Total Lines	16
Code Lines	8

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	0
CRAP Score	12

Importance

Changes

Metric	Value
cc	3
eloc	8
nc	4
nop	2
dl	0
loc	16
ccs	0
cts	12
cp	0
crap	12
rs	10
c	0
b	0
f	0

<?php

declare(strict_types=1);

namespace TMV\OpenIdClient\Token;

use Jose\Component\Checker\AudienceChecker;
use Jose\Component\Checker\ClaimCheckerManager;
use Jose\Component\Checker\ExpirationTimeChecker;
use Jose\Component\Checker\IssuedAtChecker;
use Jose\Component\Checker\IssuerChecker;
use Jose\Component\Checker\NotBeforeChecker;
use Jose\Component\Core\AlgorithmManager;
use Jose\Component\Core\JWK;
use Jose\Component\Core\JWKSet;
use Jose\Component\Signature\Algorithm\RS256;
use Jose\Component\Signature\JWSVerifier;
use Jose\Component\Signature\Serializer\CompactSerializer;
use function TMV\OpenIdClient\base64url_decode;
use TMV\OpenIdClient\ClaimChecker\AuthTimeChecker;
use TMV\OpenIdClient\ClaimChecker\AzpChecker;
use TMV\OpenIdClient\ClaimChecker\NonceChecker;
use TMV\OpenIdClient\ClientInterface;
use TMV\OpenIdClient\Exception\InvalidArgumentException;
use TMV\OpenIdClient\Exception\RuntimeException;
use TMV\OpenIdClient\IssuerInterface;
use function TMV\OpenIdClient\jose_secret_key;
use TMV\OpenIdClient\Model\AuthSessionInterface;

class IdTokenVerifier implements IdTokenVerifierInterface
{
    /** @var AlgorithmManager */
    private $algorithmManager;

    /** @var bool */
    private $aadIssValidation;

    /** @var int */
    private $clockTolerance = 0;

    /**
     * IdTokenVerifier constructor.
     *
     * @param null|AlgorithmManager $algorithmManager
     * @param bool $aadIssValidation
     * @param int $clockTolerance
     */
    public function __construct(
        ?AlgorithmManager $algorithmManager = null,
        bool $aadIssValidation = false,
        int $clockTolerance = 0
    ) {
        $this->algorithmManager = $algorithmManager ?: new AlgorithmManager([new RS256()]);
        $this->aadIssValidation = $aadIssValidation;
        $this->clockTolerance = $clockTolerance;
    }

    public function validateUserinfoToken(
        ClientInterface $client,
        string $idToken,
        ?AuthSessionInterface $authSession = null,
        ?int $maxAge = null
    ): array {
        return $this->validate($client, $idToken, $authSession, true, $maxAge);
    }

    public function validateIdToken(
        ClientInterface $client,
        string $idToken,
        ?AuthSessionInterface $authSession = null,
        ?int $maxAge = null
    ): array {
        return $this->validate($client, $idToken, $authSession, false, $maxAge);
    }

    private function validate(
        ClientInterface $client,
        string $idToken,
        ?AuthSessionInterface $authSession = null,
        bool $fromUserInfo = false,
        ?int $maxAge = null
    ): array {
        $metadata = $client->getMetadata();
        $expectedAlg = $fromUserInfo
            ? $metadata->getUserinfoSignedResponseAlg()
            : $metadata->getIdTokenSignedResponseAlg();

        if (! $expectedAlg) {
            throw new RuntimeException('Unable to verify id_token without an alg value');
        }

        $header = \json_decode(base64url_decode(\explode('.', $idToken)[0] ?? '{}'), true);

        if ($expectedAlg !== ($header['alg'] ?? '')) {
            throw new RuntimeException(\sprintf('Unexpected JWS alg received, expected %s, got: %s', $expectedAlg, $header['alg'] ?? ''));
        }

        $payload = \json_decode(base64url_decode(\explode('.', $idToken)[1] ?? '{}'), true);

        if (! \is_array($payload)) {
            throw new InvalidArgumentException('Unable to decode token payload');
        }

        $expectedIssuer = $client->getIssuer()->getMetadata()->getIssuer();

        if ($this->aadIssValidation) {
            $expectedIssuer = \str_replace('{tenantid}', $payload['tid'] ?? '', $expectedIssuer);
        }

        $nonce = $authSession ? $authSession->getNonce() : null;

        $claimCheckers = [
            new IssuerChecker([$expectedIssuer]),
            new IssuedAtChecker($this->clockTolerance),
            new AudienceChecker($metadata->getClientId()),
            new ExpirationTimeChecker($this->clockTolerance),
            new NotBeforeChecker($this->clockTolerance),
            new AzpChecker($metadata->getClientId()),
            $maxAge ? new AuthTimeChecker($maxAge, $this->clockTolerance) : null,
            $nonce ? new NonceChecker($nonce) : null,
        ];

        $requiredClaims = [];

        if (! $fromUserInfo) {
            $requiredClaims = ['iss', 'sub', 'aud', 'exp', 'iat'];
        }

        if ($maxAge || (null !== $maxAge && $metadata->get('require_auth_time'))) {
0   == false // true
0   == null  // true
123 == false // false
123 == null  // false

// It is often better to use strict comparison
0 === false // false
0 === null  // false
            $requiredClaims[] = 'auth_time';
        }

        $claimCheckerManager = new ClaimCheckerManager(\array_filter($claimCheckers));

        $claimCheckerManager->check($payload, \array_filter($requiredClaims));

        if ('none' === $expectedAlg) {
            return $payload;
        }

        $serializer = new CompactSerializer();
        $jws = $serializer->unserialize($idToken);

        $jwsVerifier = new JWSVerifier(
            $this->algorithmManager
        );

        /** @var string|null $kid */
        $kid = $header['kid'] ?? null;

        $jwks = $this->getSigningJWKSet($client, $expectedAlg, $kid);

        if (! $jwsVerifier->verifyWithKeySet($jws, $jwks, 0)) {
            throw new InvalidArgumentException('Failed to validate JWT signature');
        }

        return $payload;
    }

    private function getSigningJWKSet(ClientInterface $client, string $expectedAlg, ?string $kid = null): JWKSet
    {
        $metadata = $client->getMetadata();
        $issuer = $client->getIssuer();

        if (0 !== \strpos($expectedAlg, 'HS')) {
            // not symmetric key
            return $kid
                ? new JWKSet([$this->getIssuerJWKFromKid($issuer, $kid)])
                : $issuer->getJwks();
        }

        $clientSecret = $metadata->getClientSecret();

        if (! $clientSecret) {
            throw new RuntimeException('Unable to verify token without client_secret');
        }

        return new JWKSet([jose_secret_key($clientSecret)]);
    }

    private function getIssuerJWKFromKid(IssuerInterface $issuer, string $kid): JWK
    {
        $jwks = $issuer->getJwks();

        $jwk = $jwks->selectKey('sig', null, ['kid' => $kid]);

        if (! $jwk) {
            $issuer->updateJwks();
            $jwk = $issuer->getJwks()->selectKey('sig', null, ['kid' => $kid]);
        }

        if (! $jwk) {
            throw new RuntimeException('Unable to find the jwk with the provided kid: ' . $kid);
        }

        return $jwk;
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			namespace TMV\OpenIdClient\Token;
6
7			use Jose\Component\Checker\AudienceChecker;
8			use Jose\Component\Checker\ClaimCheckerManager;
9			use Jose\Component\Checker\ExpirationTimeChecker;
10			use Jose\Component\Checker\IssuedAtChecker;
11			use Jose\Component\Checker\IssuerChecker;
12			use Jose\Component\Checker\NotBeforeChecker;
13			use Jose\Component\Core\AlgorithmManager;
14			use Jose\Component\Core\JWK;
15			use Jose\Component\Core\JWKSet;
16			use Jose\Component\Signature\Algorithm\RS256;
17			use Jose\Component\Signature\JWSVerifier;
18			use Jose\Component\Signature\Serializer\CompactSerializer;
19			use function TMV\OpenIdClient\base64url_decode;
20			use TMV\OpenIdClient\ClaimChecker\AuthTimeChecker;
21			use TMV\OpenIdClient\ClaimChecker\AzpChecker;
22			use TMV\OpenIdClient\ClaimChecker\NonceChecker;
23			use TMV\OpenIdClient\ClientInterface;
24			use TMV\OpenIdClient\Exception\InvalidArgumentException;
25			use TMV\OpenIdClient\Exception\RuntimeException;
26			use TMV\OpenIdClient\IssuerInterface;
27			use function TMV\OpenIdClient\jose_secret_key;
28			use TMV\OpenIdClient\Model\AuthSessionInterface;
29
30			class IdTokenVerifier implements IdTokenVerifierInterface
31			{
32			/** @var AlgorithmManager */
33			private $algorithmManager;
34
35			/** @var bool */
36			private $aadIssValidation;
37
38			/** @var int */
39			private $clockTolerance = 0;
40
41			/**
42			* IdTokenVerifier constructor.
43			*
44			* @param null\|AlgorithmManager $algorithmManager
45			* @param bool $aadIssValidation
46			* @param int $clockTolerance
47			*/
48			public function __construct(
49			?AlgorithmManager $algorithmManager = null,
50			bool $aadIssValidation = false,
51			int $clockTolerance = 0
52			) {
53			$this->algorithmManager = $algorithmManager ?: new AlgorithmManager([new RS256()]);
54			$this->aadIssValidation = $aadIssValidation;
55			$this->clockTolerance = $clockTolerance;
56			}
57
58			public function validateUserinfoToken(
59			ClientInterface $client,
60			string $idToken,
61			?AuthSessionInterface $authSession = null,
62			?int $maxAge = null
63			): array {
64			return $this->validate($client, $idToken, $authSession, true, $maxAge);
65			}
66
67			public function validateIdToken(
68			ClientInterface $client,
69			string $idToken,
70			?AuthSessionInterface $authSession = null,
71			?int $maxAge = null
72			): array {
73			return $this->validate($client, $idToken, $authSession, false, $maxAge);
74			}
75
76			private function validate(
77			ClientInterface $client,
78			string $idToken,
79			?AuthSessionInterface $authSession = null,
80			bool $fromUserInfo = false,
81			?int $maxAge = null
82			): array {
83			$metadata = $client->getMetadata();
84			$expectedAlg = $fromUserInfo
85			? $metadata->getUserinfoSignedResponseAlg()
86			: $metadata->getIdTokenSignedResponseAlg();
87
88			if (! $expectedAlg) {
89			throw new RuntimeException('Unable to verify id_token without an alg value');
90			}
91
92			$header = \json_decode(base64url_decode(\explode('.', $idToken)[0] ?? '{}'), true);
93
94			if ($expectedAlg !== ($header['alg'] ?? '')) {
95			throw new RuntimeException(\sprintf('Unexpected JWS alg received, expected %s, got: %s', $expectedAlg, $header['alg'] ?? ''));
96			}
97
98			$payload = \json_decode(base64url_decode(\explode('.', $idToken)[1] ?? '{}'), true);
99
100			if (! \is_array($payload)) {
101			throw new InvalidArgumentException('Unable to decode token payload');
102			}
103
104			$expectedIssuer = $client->getIssuer()->getMetadata()->getIssuer();
105
106			if ($this->aadIssValidation) {
107			$expectedIssuer = \str_replace('{tenantid}', $payload['tid'] ?? '', $expectedIssuer);
108			}
109
110			$nonce = $authSession ? $authSession->getNonce() : null;
111
112			$claimCheckers = [
113			new IssuerChecker([$expectedIssuer]),
114			new IssuedAtChecker($this->clockTolerance),
115			new AudienceChecker($metadata->getClientId()),
116			new ExpirationTimeChecker($this->clockTolerance),
117			new NotBeforeChecker($this->clockTolerance),
118			new AzpChecker($metadata->getClientId()),
119			$maxAge ? new AuthTimeChecker($maxAge, $this->clockTolerance) : null,
120			$nonce ? new NonceChecker($nonce) : null,
121			];
122
123			$requiredClaims = [];
124
125			if (! $fromUserInfo) {
126			$requiredClaims = ['iss', 'sub', 'aud', 'exp', 'iat'];
127			}
128
129			if ($maxAge \|\| (null !== $maxAge && $metadata->get('require_auth_time'))) {
			0 ignored issues – show Bug Best Practice introduced 2019-07-08 12:02 UTC by Report Bug Copy Issue Report The expression `$maxAge` of type `integer\|null` is loosely compared to `true`; this is ambiguous if the integer can be 0. You might want to explicitly use `!== null` instead. In PHP, under loose comparison (like `==`, or `!=`, or `switch` conditions), values of different types might be equal. For `integer` values, zero is a special case, in particular the following results might be unexpected: 0 == false // true 0 == null // true 123 == false // false 123 == null // false // It is often better to use strict comparison 0 === false // false 0 === null // false Loading history...
130			$requiredClaims[] = 'auth_time';
131			}
132
133			$claimCheckerManager = new ClaimCheckerManager(\array_filter($claimCheckers));
134
135			$claimCheckerManager->check($payload, \array_filter($requiredClaims));
136
137			if ('none' === $expectedAlg) {
138			return $payload;
139			}
140
141			$serializer = new CompactSerializer();
142			$jws = $serializer->unserialize($idToken);
143
144			$jwsVerifier = new JWSVerifier(
145			$this->algorithmManager
146			);
147
148			/** @var string\|null $kid */
149			$kid = $header['kid'] ?? null;
150
151			$jwks = $this->getSigningJWKSet($client, $expectedAlg, $kid);
152
153			if (! $jwsVerifier->verifyWithKeySet($jws, $jwks, 0)) {
154			throw new InvalidArgumentException('Failed to validate JWT signature');
155			}
156
157			return $payload;
158			}
159
160			private function getSigningJWKSet(ClientInterface $client, string $expectedAlg, ?string $kid = null): JWKSet
161			{
162			$metadata = $client->getMetadata();
163			$issuer = $client->getIssuer();
164
165			if (0 !== \strpos($expectedAlg, 'HS')) {
166			// not symmetric key
167			return $kid
168			? new JWKSet([$this->getIssuerJWKFromKid($issuer, $kid)])
169			: $issuer->getJwks();
170			}
171
172			$clientSecret = $metadata->getClientSecret();
173
174			if (! $clientSecret) {
175			throw new RuntimeException('Unable to verify token without client_secret');
176			}
177
178			return new JWKSet([jose_secret_key($clientSecret)]);
179			}
180
181			private function getIssuerJWKFromKid(IssuerInterface $issuer, string $kid): JWK
182			{
183			$jwks = $issuer->getJwks();
184
185			$jwk = $jwks->selectKey('sig', null, ['kid' => $kid]);
186
187			if (! $jwk) {
188			$issuer->updateJwks();
189			$jwk = $issuer->getJwks()->selectKey('sig', null, ['kid' => $kid]);
190			}
191
192			if (! $jwk) {
193			throw new RuntimeException('Unable to find the jwk with the provided kid: ' . $kid);
194			}
195
196			return $jwk;
197			}
198			}
199

thomasvargiu / php-openid-client

Push — master ( c8bc96...3cc4a7 )

IdTokenVerifier::getIssuerJWKFromKid() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like