refactor(config,jwx): update from lestrrat-go/jwx v3 to v4 and integrate SignatureAlgorithm for YAML compatibility

Author: zachmann

internal/config/config.go

@@ -50,7 +50,7 @@ var defaultConfig = Config{
 	},
 	Signing: signingConfs{
 		Mytoken: signingConf{
-			Alg:       SignatureAlgorithm{SignatureAlgorithm: jwa.ES512()},
+			Alg:       "ES512",
 			RSAKeyLen: 2048,
 		},
 		OIDC: oidcSigningConf{
@@ -126,7 +126,7 @@ var defaultConfig = Config{
 			Enabled:                     false,
 			EntityConfigurationLifetime: 7 * 24 * 60 * 60,
 			Signing: signingConf{
-				Alg:       SignatureAlgorithm{SignatureAlgorithm: jwa.ES512()},
+				Alg:       "ES512",
 				RSAKeyLen: 2048,
 			},
 			OPDiscovery: opDiscoveryConf{
@@ -453,33 +453,9 @@ type signingConfs struct {
 }
 
 type signingConf struct {
-	Alg       SignatureAlgorithm `yaml:"alg"`
-	KeyFile   string             `yaml:"key_file"`
-	RSAKeyLen int                `yaml:"rsa_key_len"`
-}
-
-// SignatureAlgorithm is a jwa.SignatureAlgorithm that can be marshalled to and unmarshalled from YAML.
-type SignatureAlgorithm struct {
-	jwa.SignatureAlgorithm
-}
-
-// UnmarshalYAML implements yaml.Unmarshaler for SignatureAlgorithm.
-func (a *SignatureAlgorithm) UnmarshalYAML(value *yaml.Node) error {
-	var s string
-	if err := value.Decode(&s); err != nil {
-		return errors.Wrap(err, "invalid signing algorithm")
-	}
-	alg, ok := jwa.LookupSignatureAlgorithm(s)
-	if !ok {
-		return errors.Errorf("unknown signing algorithm '%s'", s)
-	}
-	a.SignatureAlgorithm = alg
-	return nil
-}
-
-// MarshalYAML implements yaml.Marshaler for SignatureAlgorithm.
-func (a SignatureAlgorithm) MarshalYAML() (interface{}, error) {
-	return a.String(), nil
+	Alg       string `yaml:"alg"`
+	KeyFile   string `yaml:"key_file"`
+	RSAKeyLen int    `yaml:"rsa_key_len"`
 }
 
 // oidcSigningConf holds configuration for OIDC signing with multiple algorithms
@@ -653,9 +629,12 @@ func (f *federationConf) validate() (err error) {
 	if f.Signing.KeyFile == "" {
 		return errors.New("federation enabled, but no signing keyfile specified")
 	}
-	if f.Signing.Alg.String() == "" {
+	if f.Signing.Alg == "" {
 		return errors.New("federation enabled, but no signing alg specified")
 	}
+	if _, ok := jwa.LookupSignatureAlgorithm(f.Signing.Alg); !ok {
+		return errors.Errorf("federation enabled, but unknown signing alg '%s' specified", f.Signing.Alg)
+	}
 	if f.EntityConfigurationLifetime == 0 {
 		f.EntityConfigurationLifetime = 7 * 24 * 60 * 60
 	}
@@ -819,9 +798,12 @@ func validateSigningConfig() error {
 	if conf.Signing.Mytoken.KeyFile == "" {
 		return errors.New("invalid config: signing keyfile not set")
 	}
-	if conf.Signing.Mytoken.Alg.String() == "" {
+	if conf.Signing.Mytoken.Alg == "" {
 		return errors.New("invalid config: token signing alg not set")
 	}
+	if _, ok := jwa.LookupSignatureAlgorithm(conf.Signing.Mytoken.Alg); !ok {
+		return errors.Errorf("invalid config: unknown token signing alg '%s'", conf.Signing.Mytoken.Alg)
+	}
 	return nil
 }
 

internal/endpoints/configuration/configurationEndpoint.go

@@ -81,7 +81,7 @@ func basicConfiguration() *pkg.MytokenConfiguration {
 			ProfilesEndpoint:      utils.CombineURLPath(config.Get().IssuerURL, apiPaths.ProfilesEndpoint),
 			JWKSURI:               utils.CombineURLPath(config.Get().IssuerURL, otherPaths.JWKSEndpoint),
 			ProvidersSupported:    getProvidersFromConfig(),
-			TokenSigningAlgValue:  config.Get().Signing.Mytoken.Alg.String(),
+			TokenSigningAlgValue:  config.Get().Signing.Mytoken.Alg,
 			ServiceDocumentation:  config.Get().ServiceDocumentation,
 			Version:               version.VERSION,
 		},

internal/jws/jws.go

@@ -24,18 +24,24 @@ import (
 // GenerateMytokenSigningKeyPair generates a cryptographic key pair for mytoken signing with the algorithm specified in
 // the mytoken config.
 func GenerateMytokenSigningKeyPair() (sk crypto.Signer, pk crypto.PublicKey, err error) {
-	return generateKeyPair(config.Get().Signing.Mytoken.Alg.SignatureAlgorithm, config.Get().Signing.Mytoken.RSAKeyLen)
+	return generateKeyPair(algFromConfig(config.Get().Signing.Mytoken.Alg), config.Get().Signing.Mytoken.RSAKeyLen)
 }
 
 // GenerateFederationSigningKeyPair generates a cryptographic key pair for federation signing with the algorithm
 // specified in the config.
 func GenerateFederationSigningKeyPair() (sk crypto.Signer, pk crypto.PublicKey, err error) {
 	return generateKeyPair(
-		config.Get().Features.Federation.Signing.Alg.SignatureAlgorithm,
+		algFromConfig(config.Get().Features.Federation.Signing.Alg),
 		config.Get().Features.Federation.Signing.RSAKeyLen,
 	)
 }
 
+// algFromConfig converts a signing algorithm string from the config to a jwa.SignatureAlgorithm.
+func algFromConfig(s string) jwa.SignatureAlgorithm {
+	alg, _ := jwa.LookupSignatureAlgorithm(s)
+	return alg
+}
+
 // generateKeyPair generates a cryptographic key pair with the passed properties
 func generateKeyPair(alg jwa.SignatureAlgorithm, rsaKeyLen int) (
 	sk crypto.Signer, pk crypto.PublicKey,
@@ -185,9 +191,9 @@ func GetVersatileSigner(usage KeyUsage) jwx.VersatileSigner {
 	var alg jwa.SignatureAlgorithm
 	switch usage {
 	case KeyUsageMytokenSigning:
-		alg = config.Get().Signing.Mytoken.Alg.SignatureAlgorithm
+		alg = algFromConfig(config.Get().Signing.Mytoken.Alg)
 	case KeyUsageFederation:
-		alg = config.Get().Features.Federation.Signing.Alg.SignatureAlgorithm
+		alg = algFromConfig(config.Get().Features.Federation.Signing.Alg)
 	}
 	return jwx.NewSingleKeyVersatileSigner(k.SK, alg)
 }
@@ -196,7 +202,7 @@ func GetVersatileSigner(usage KeyUsage) jwx.VersatileSigner {
 func LoadMytokenSigningKey() {
 	loadKey(
 		config.Get().Signing.Mytoken.KeyFile, KeyUsageMytokenSigning,
-		config.Get().Signing.Mytoken.Alg.SignatureAlgorithm,
+		algFromConfig(config.Get().Signing.Mytoken.Alg),
 	)
 }
 
@@ -249,7 +255,7 @@ func LoadOIDCSigningKey() error {
 func LoadFederationKey() {
 	loadKey(
 		config.Get().Features.Federation.Signing.KeyFile, KeyUsageFederation,
-		config.Get().Features.Federation.Signing.Alg.SignatureAlgorithm,
+		algFromConfig(config.Get().Features.Federation.Signing.Alg),
 	)
 }
 

internal/mytoken/pkg/mytoken.go

@@ -281,7 +281,7 @@ func (mt *Mytoken) ToJWT() (string, error) {
 	}
 	var err error
 	j := jwt.NewWithClaims(
-		jwt.GetSigningMethod(config.Get().Signing.Mytoken.Alg.String()), mt,
+		jwt.GetSigningMethod(config.Get().Signing.Mytoken.Alg), mt,
 	)
 	j.Header["typ"] = "MT+JWT"
 	mt.jwt, err = j.SignedString(jws.GetSigningKey(jws.KeyUsageMytokenSigning))