omniauth_openid_federation 1.3.0 → 2.0.0

data/lib/omniauth_openid_federation/federation/trust_chain_resolver.rb

@@ -1,11 +1,15 @@
+require "cgi"
+require "json"
+require "base64"
+require "jwt"
 require_relative "entity_statement"
 require_relative "entity_statement_validator"
 require_relative "../http_client"
 require_relative "../logger"
 require_relative "../errors"
 require_relative "../utils"
-require "set"
-require "cgi"
+require_relative "../string_helpers"
+require_relative "../key_extractor"
 
 # Trust Chain Resolver for OpenID Federation 1.0
 # @see https://openid.net/specs/openid-federation-1_0.html#section-10 Section 10: Trust Chain Resolution
@@ -49,6 +53,7 @@ module OmniauthOpenidFederation
         @timeout = timeout
         @resolved_statements = []
         @visited_entities = Set.new
+        @entity_configurations = {}
       end
 
       # Resolve the trust chain
@@ -59,24 +64,21 @@ module OmniauthOpenidFederation
       def resolve!
         OmniauthOpenidFederation::Logger.debug("[TrustChainResolver] Starting trust chain resolution for: #{@leaf_entity_id}")
 
-        # Step 1: Fetch Leaf Entity's Entity Configuration
         leaf_config = fetch_entity_configuration(@leaf_entity_id)
-        validate_entity_statement(leaf_config, nil) # No issuer for Entity Configuration
+        validate_entity_statement(leaf_config, nil)
         @resolved_statements << leaf_config
         @visited_entities.add(@leaf_entity_id)
 
-        # Step 2: Follow authority_hints to build the chain
         current_entity_id = @leaf_entity_id
         current_config = leaf_config
 
         while current_config && !is_trust_anchor?(current_config)
           authority_hints = extract_authority_hints(current_config)
 
-          if authority_hints.nil? || authority_hints.empty?
+          if StringHelpers.blank?(authority_hints)
             raise ValidationError, "Entity #{current_entity_id} has no authority_hints and is not a Trust Anchor"
           end
 
-          # Try each authority hint until we find a valid chain
           found_next = false
           authority_hints.each do |authority_id|
             next if @visited_entities.include?(authority_id)
@@ -86,28 +88,24 @@ module OmniauthOpenidFederation
             end
 
             begin
-              # Fetch Subordinate Statement from authority
+              issuer_config = fetch_entity_configuration(authority_id)
               subordinate_statement = fetch_subordinate_statement(
                 issuer: authority_id,
-                subject: current_entity_id
+                subject: current_entity_id,
+                issuer_config: issuer_config
               )
 
-              # Validate Subordinate Statement
-              issuer_config = fetch_entity_configuration(authority_id)
               validate_entity_statement(subordinate_statement, issuer_config)
 
-              # Add to chain
               @resolved_statements << subordinate_statement
               @visited_entities.add(authority_id)
 
-              # Continue with issuer as next entity
               current_entity_id = authority_id
               current_config = issuer_config
               found_next = true
               break
             rescue ValidationError, FetchError => e
               OmniauthOpenidFederation::Logger.warn("[TrustChainResolver] Failed to resolve via #{authority_id}: #{e.message}")
-              # Instrument trust chain validation failure
               OmniauthOpenidFederation::Instrumentation.notify_trust_chain_validation_failed(
                 entity_id: current_entity_id,
                 trust_anchor: authority_id,
@@ -124,10 +122,8 @@ module OmniauthOpenidFederation
           end
         end
 
-        # Step 3: Verify we reached a Trust Anchor
         unless is_trust_anchor?(current_config)
           error_msg = "Trust chain did not terminate at a configured Trust Anchor"
-          # Instrument trust chain validation failure
           OmniauthOpenidFederation::Instrumentation.notify_trust_chain_validation_failed(
             entity_id: @leaf_entity_id,
             trust_anchor: current_entity_id,
@@ -153,26 +149,26 @@ module OmniauthOpenidFederation
       end
 
       def fetch_entity_configuration(entity_id)
+        return @entity_configurations[entity_id] if @entity_configurations.key?(entity_id)
+
         entity_statement_url = OmniauthOpenidFederation::Utils.build_entity_statement_url(entity_id)
         OmniauthOpenidFederation::Logger.debug("[TrustChainResolver] Fetching Entity Configuration from: #{entity_statement_url}")
 
         begin
-          EntityStatement.fetch!(entity_statement_url, timeout: @timeout)
+          config = EntityStatement.fetch!(entity_statement_url, timeout: @timeout)
+          @entity_configurations[entity_id] = config
         rescue OmniauthOpenidFederation::NetworkError => e
           raise FetchError, "Failed to fetch entity configuration from #{entity_statement_url}: #{e.message}"
         end
       end
 
-      def fetch_subordinate_statement(issuer:, subject:)
-        # Try to get fetch endpoint from issuer's Entity Configuration
-        issuer_config = fetch_entity_configuration(issuer)
+      def fetch_subordinate_statement(issuer:, subject:, issuer_config:)
         fetch_endpoint = extract_fetch_endpoint(issuer_config)
 
         unless fetch_endpoint
           raise FetchError, "Issuer #{issuer} does not provide a fetch endpoint"
         end
 
-        # Build fetch URL with iss and sub parameters
         fetch_url = "#{fetch_endpoint}?iss=#{CGI.escape(issuer)}&sub=#{CGI.escape(subject)}"
         OmniauthOpenidFederation::Logger.debug("[TrustChainResolver] Fetching Subordinate Statement from: #{fetch_url}")
 
@@ -210,6 +206,43 @@ module OmniauthOpenidFederation
           issuer_entity_configuration: issuer_config
         )
         validator.validate!
+        verify_entity_statement_signature!(statement, issuer_config)
+      end
+
+      def verify_entity_statement_signature!(statement, issuer_config)
+        jwt_string = statement.entity_statement
+        parts = jwt_string.split(".")
+        if parts.length != EntityStatementValidator::JWT_PARTS_COUNT
+          raise ValidationError, "Invalid JWT format: expected #{EntityStatementValidator::JWT_PARTS_COUNT} parts, got #{parts.length}"
+        end
+
+        header = JSON.parse(Base64.urlsafe_decode64(parts[0]))
+        kid = header["kid"] || header[:kid]
+
+        signing_keys = issuer_signing_keys(statement, issuer_config)
+        keys = signing_keys["keys"] || signing_keys[:keys] || []
+        signing_key_data = keys.find { |key| (key["kid"] || key[:kid]) == kid }
+
+        unless signing_key_data
+          raise ValidationError, "Signing key with kid '#{kid}' not found in issuer JWKS for signature verification"
+        end
+
+        public_key = OmniauthOpenidFederation::KeyExtractor.jwk_to_openssl_key(signing_key_data)
+        ::JWT.decode(jwt_string, public_key, true, {algorithm: "RS256"})
+      rescue ::JWT::DecodeError, ::JWT::VerificationError => e
+        error_msg = "Entity statement signature validation failed: #{e.class} - #{e.message}"
+        OmniauthOpenidFederation::Logger.error("[TrustChainResolver] #{error_msg}")
+        raise SignatureError, error_msg, e.backtrace
+      end
+
+      def issuer_signing_keys(statement, issuer_config)
+        if issuer_config.nil?
+          parsed = statement.parse
+          parsed[:jwks] || parsed["jwks"] || {}
+        else
+          issuer_parsed = issuer_config.parse
+          issuer_parsed[:jwks] || issuer_parsed["jwks"] || {}
+        end
       end
 
       def is_trust_anchor?(entity_config)