search

smallrye / smallrye-jwt

Apache License 2.0
75 stars 49 forks source link

Fix IllegalArgumentException when using EDDSA signature algorithm #799

Closed 0rzech closed 5 months ago

0rzech commented 5 months ago

This fixes java.lang.IllegalArgumentException: No enum constant io.smallrye.jwt.algorithm.SignatureAlgorithm.EdDSA when EDDSA is set through smallrye.jwt.new-token.signature-algorithm property, or when it is set with JwtClaimsBuilderImpl.

Currently, JwtSignatureImpl.getConfiguredSignatureAlgorithm() returns algorithm name as a String from SignatureAlgorithm.algorithmName field, in case of it being loaded from a configuration file.

If the algorithm was set through JwtClaimsBuilderImpl, the value is returned as-is from the header, which means EdDSA, because this is how JwtClaimsBuilderImpl puts the value there.

This name is then used to get appropriate SignatureAlgorithm enum variant in JwtSignatureImpl.getSigningKeyFromKeyContent(String), but without using toUpperCase() on the name, causing exception when EdDSA is used.

The fix adds toUpperCase() call on algorithm name before passing it to SignatureAlgorithm.fromAlgorithm(String).

0rzech commented 5 months ago

It is also possible to call toUpperCase() here, but it would make algorithm naming lax everywyhere, as SignatureAlgorithm.fromAlgorithm(String) is also used here.

Alternatively, EDDSA("EdDSA") could be changed to EDDSA("EDDSA") here, because the public interface seems to expect all letters to be upper case when using builder anyway, so the change should not be breaking.

0rzech commented 5 months ago

Closing in favour of #800 .