IdentityPython / idpy-oidc

Implementation of everything OIDC and OAuth2
Apache License 2.0
40 stars 22 forks source link

[BUG] idpy-oidc can't handle as many signature alorythms as cryptojwt #105

Closed Yoroitchi closed 5 months ago

Yoroitchi commented 5 months ago

Hello,

I'm currently working on a project wich consists of setting up the solution SATOSA (https://github.com/IdentityPython/SATOSA) to allow translation between SAML and OIDC. I'm using the module satosa_oidcop (https://github.com/UniversitaDellaCalabria/SATOSA-oidcop) which is based on idpy_oidc op features.

On start up, satosa crashed with the following logs :

[2024-05-27 11:18:19,399] [ERROR] [satosa.proxy_server.make_app] Failed to create WSGI app. Traceback (most recent call last): File "/usr/local/lib/python3.9/site-packages/satosa/proxy_server.py", line 192, in make_app res1 = WsgiApplication(satosa_config) File "/usr/local/lib/python3.9/site-packages/satosa/proxy_server.py", line 118, in init super().init(config) File "/usr/local/lib/python3.9/site-packages/satosa/base.py", line 45, in init frontends = load_frontends(self.config, self._auth_req_callback_func, File "/usr/local/lib/python3.9/site-packages/satosa/plugin_loader.py", line 68, in load_frontends frontend_modules = _load_plugins(config.get("CUSTOM_PLUGIN_MODULE_PATHS"), config["FRONTEND_MODULES"], File "/usr/local/lib/python3.9/site-packages/satosa/plugin_loader.py", line 181, in _load_plugins instance = module_class(callback, internal_attributes, module_config, base_url, File "/usr/local/lib/python3.9/site-packages/satosa_oidcop/idpy_oidcop.py", line 594, in init self.app = oidcop_app(conf) File "/usr/local/lib/python3.9/site-packages/satosa_oidcop/core/application.py", line 23, in oidcop_application app = oidc_provider_init_app(config) File "/usr/local/lib/python3.9/site-packages/satosa_oidcop/core/application.py", line 16, in oidc_provider_init_app app.server = Server(config, cwd=folder) File "/usr/local/lib/python3.9/site-packages/idpyoidc/server/init.py", line 72, in init self.context = EndpointContext( File "/usr/local/lib/python3.9/site-packages/idpyoidc/server/endpoint_context.py", line 240, in init _supports = self.supports() File "/usr/local/lib/python3.9/site-packages/idpyoidc/server/endpoint_context.py", line 406, in supports res.update(endpoint.supports()) File "/usr/local/lib/python3.9/site-packages/idpyoidc/server/endpoint.py", line 485, in supports res[key] = val() File "/usr/local/lib/python3.9/site-packages/idpyoidc/claims.py", line 252, in get_signing_algs return sorted(_list, key=cmp_to_key(alg_cmp)) File "/usr/local/lib/python3.9/site-packages/idpyoidc/claims.py", line 235, in alg_cmp _pos1 = SIGNING_ALGORITHM_SORT_ORDER.index(a[0:2]) ValueError: 'Ed' is not in list

I managed the make a correction as follow :

SIGNING_ALGORITHM_SORT_ORDER = ["RS", "ES", "PS", "HS"] -> SIGNING_ALGORITHM_SORT_ORDER = ["RS", "ES", "Ed","PS", "HS"]

After that, all seems to work flawlessly The issue comes from the module cryptojwt in cryptojwt/jws/jws.py : SIGNER_ALGS = { "HS256": HMACSigner("SHA256"), "HS384": HMACSigner("SHA384"), "HS512": HMACSigner("SHA512"), "RS256": RSASigner("RS256"), "RS384": RSASigner("RS384"), "RS512": RSASigner("RS512"), "ES256": ECDSASigner("ES256"), "ES256K": ECDSASigner("ES256K"), "ES384": ECDSASigner("ES384"), "ES512": ECDSASigner("ES512"), "PS256": PSSSigner("SHA256"), "PS384": PSSSigner("SHA384"), "PS512": PSSSigner("SHA512"), "EdDSA": EDDSASigner(), "Ed25519": EDDSASigner("Ed25519"), "Ed448": EDDSASigner("Ed448"), "none": None, } Tbh i'm to lazy to make a PR right now so i'm writing the solution here. Also any feedback on this workaround is welcome, as i am not sure that this issue is related to the project or if it is an issue to satosa_oidcop

Have a nice day

Yoroitchi commented 5 months ago

My mistake, satosa is using an outdated version of this module