rp_python_sdk 0.9.0__tar.gz → 0.10.0__tar.gz

{rp_python_sdk-0.9.0 → rp_python_sdk-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: rp_python_sdk
-Version: 0.9.0
+Version: 0.10.0
 Summary: Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem
 License: Proprietary
 Author: Erik Pragt
@@ -426,6 +426,9 @@ poetry publish
 
 ## Release Notes
 
+### 0.10.0 (Oct 24, 2024)
+- JWT signature verification for id_token in the retrieve_tokens step.
+
 ### 0.9.0 (Oct 18, 2024)
 - Added support for Python 3.13
 - Added support for `payment` ApiResources

{rp_python_sdk-0.9.0 → rp_python_sdk-0.10.0}/README.md

@@ -407,6 +407,9 @@ poetry publish
 
 ## Release Notes
 
+### 0.10.0 (Oct 24, 2024)
+- JWT signature verification for id_token in the retrieve_tokens step.
+
 ### 0.9.0 (Oct 18, 2024)
 - Added support for Python 3.13
 - Added support for `payment` ApiResources

{rp_python_sdk-0.9.0 → rp_python_sdk-0.10.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rp_python_sdk"
-version = "0.9.0"
+version = "0.10.0"
 description = "Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem"
 authors = ["Erik Pragt <erik.pragt@connectid.com.au>"]
 license = "Proprietary"
@@ -21,7 +21,7 @@ httpx = "^0.27.2"
 [tool.poetry.group.dev.dependencies]
 black = "^24.10.0"
 pre-commit = "^3.8.0"
-mypy = "^1.11.2"
+mypy = "^1.13.0"
 requests-mock = "^1.12.1"
 freezegun = "^1.4.0"
 flake8 = "^7.1.1"

{rp_python_sdk-0.9.0 → rp_python_sdk-0.10.0}/rp_python_sdk/endpoints/retrieve_tokens.py

@@ -8,6 +8,9 @@ import requests
 from joserfc import jws
 from joserfc.jwk import RSAKey
 from joserfc.jws import JWSRegistry
+from authlib.jose import JsonWebToken
+from authlib.jose.errors import BadSignatureError, DecodeError
+from authlib.jose.util import extract_header
 
 from rp_python_sdk.endpoints.get_participants import get_issuer_metadata, \
     get_auth_server_details
@@ -103,7 +106,7 @@ def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_bo
     jwks_response_body = _get_jwks_json(issuer_metadata, x_fapi_interaction_id)
     allowed_algs = issuer_metadata.id_token_signing_alg_values_supported
 
-    header, payload = _validate(token_input, jwks_response_body, allowed_algs, nonce, client_id, callback_body)
+    header, payload = _validate(token_input, jwks_response_body, allowed_algs, nonce, client_id, callback_body, issuer_metadata.issuer)
 
     token_set = TokenSet(token_input, payload, x_fapi_interaction_id)
 
@@ -119,7 +122,7 @@ def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_bo
 
 def _validate(token_input: TokenInput, jwks_response_body: dict[str, Any], allowed_algs: list[str],
               nonce: str, client_id: str,
-              callback_body: CallbackBody) -> Tuple[dict[str, Any], dict[str, Any]]:
+              callback_body: CallbackBody, issuer: str) -> Tuple[dict[str, Any], dict[str, Any]]:
     """
     Decode and parse an ID token into JSON objects for header and payload.
 
@@ -129,18 +132,18 @@ def _validate(token_input: TokenInput, jwks_response_body: dict[str, Any], allow
     :param nonce
     :param client_id
     :param callback_body
+    :param issuer
     :return: two dictionaries for header and payload
     """
     id_token = token_input.id_token
-    header_base64 = id_token.split('.')[0]
-    header = _decode_base64(header_base64)
-    header_json = json.loads(header)
+    header_json = _get_unverified_header(id_token)
 
     payload_base64 = id_token.split('.')[1]
     payload = _decode_base64(payload_base64)
     payload_json = json.loads(payload)
 
-    _validate_header(header_json, jwks_response_body, allowed_algs, id_token)
+    _validate_header(header_json, allowed_algs)
+    _validate_signature(issuer, client_id, allowed_algs, id_token, jwks_response_body)
     _validate_payload(payload_json, nonce, callback_body, client_id)
 
     return header_json, payload_json
@@ -193,6 +196,8 @@ def _validate_payload(json_payload: dict[str, Any], nonce: str, callback_body: C
         if json_payload['aud'] != client_id:
             raise RelyingPartyClientSdkException('aud claim in token response does not match client ID')
 
+def _get_unverified_header(id_token:str) -> Any:
+    return extract_header(id_token.split('.')[0].encode(), DecodeError)
 
 def _decode_base64(base64_str: str) -> str:
     """
@@ -204,51 +209,61 @@ def _decode_base64(base64_str: str) -> str:
     return decoded_bytes.decode('utf-8')
 
 
-def _validate_header(json_header, jwks, allowed_algs, id_token: str) -> None:
+def _validate_header(json_header: dict, allowed_algs: list) -> None:
     if 'alg' not in json_header or json_header['alg'] == 'none':
         raise RelyingPartyClientSdkException("no alg value in the token response jwt header")
 
     if 'kid' not in json_header:
         raise RelyingPartyClientSdkException("no kid value in the token response jwt header")
 
-    kid = json_header['kid']
-    jwk = None
-
-    for key_element in jwks.get('keys', []):
-        if _matching_kid(kid, key_element) and _none_or_matching_alg(json_header, key_element):
-            jwk = key_element
-            break
-
-    if jwk is None:
-        raise RelyingPartyClientSdkException(
-            f"kid provided does not match any key in the jwks for specified algorithm in "
-            f"token header: {json_header['alg']}")
-
     found_alg = any(alg.lower() == json_header['alg'].lower() for alg in allowed_algs)
     if not found_alg:
         raise RelyingPartyClientSdkException(
-            "alg value in id token header is not one of the supported algorithms listed on the well-known")
-
-    # try:
-    #     validate_signature(token_input.get('id_token'), jwk)
-    # except (JOSEError, ValueError) as e:
-    #     raise RelyingPartyClientSdkException(f"exception while validation jwt signature: {e}")
+            f"alg value in id token header is not one of the supported algorithms listed on the well-known. "
+            f"Provided alg {json_header['alg']}")
 
-
-def _validate_signature(self, id_token, jwk):
-    # Implement JWT signature validation based on the jwk provided and the library you're using
-    pass
-
-
-def _matching_kid(kid: str, key_element) -> bool:
-    # Implement this to match the 'kid' from the JWT with one from the JWKS
+def _find_key_in_jwks(kid: str, token_alg: str, jwks: dict) -> Any:
+    for key_element in jwks.get('keys', []):
+        if _matching_kid(kid, key_element) and _matching_alg(token_alg, key_element) and _matching_use(key_element):
+            return key_element
+    return None
+
+def _validate_signature(issuer: str, audience: str, allowed_alg: list, id_token: str, jwks: dict) -> None:
+    try:
+        # Pub key extraction
+        header = _get_unverified_header(id_token)
+        kid = header['kid']
+        alg = header['alg']
+        jwk = _find_key_in_jwks(kid, alg, jwks)
+
+        if jwk is None:
+            raise RelyingPartyClientSdkException(
+                f"kid and alg provided does not match any key in the jwks for specified algorithm in "
+                f"token header, kid: {kid}, alg: {alg}")
+
+        # Decode JWT with signature verification
+        claims_options = {
+            "iss": {"essential": True, "value": issuer},
+            "aud": {"essential": True, "value": audience}
+        }
+        jwt = JsonWebToken(allowed_alg)
+        claims = jwt.decode(id_token, key=jwk, claims_options=claims_options)
+        claims.validate()
+        logger.info("JWT signature is valid")
+    except BadSignatureError as e:
+        raise RelyingPartyClientSdkException(f"Invalid JWT signature: {e}, token data: {e.result}")
+    except Exception as e:
+        logger.debug(f"Invalid JWT token: {id_token}")
+        raise RelyingPartyClientSdkException(f"Invalid JWT signature: {e}")
+
+def _matching_use(key_element: dict) -> bool:
+    return key_element.get('use') == "sig"
+
+def _matching_kid(kid: str, key_element: dict) -> bool:
     return key_element.get('kid') == kid
 
-
-def _none_or_matching_alg(json_header, key_element) -> bool:
-    # Implement this to check if the 'alg' in JWT matches the one in the key element, if required
-    return True
-
+def _matching_alg(token_alg: str, key_element: dict) -> bool:
+    return  key_element.get("alg") is None or key_element.get("alg") == token_alg
 
 def _get_jwks_json(issuer_metadata: IssuerMetadata, x_fapi_interaction_id: str) -> Any:
     headers = {
@@ -263,4 +278,4 @@ def _get_jwks_json(issuer_metadata: IssuerMetadata, x_fapi_interaction_id: str)
             f"Response code for JWKS to {issuer_metadata.jwks_uri} not successful, was: {response.status_code}, "
             f"x-fapi-interaction-id: {x_fapi_interaction_id}, response body: {response.text}")
 
-    return response.json()
+    return response.json()

{rp_python_sdk-0.9.0 → rp_python_sdk-0.10.0}/rp_python_sdk/endpoints/util/mapping.py

@@ -32,7 +32,7 @@ def from_dict(data_class: Type[T], data: Union[dict, list], pascal_case=False) -
     for field, field_type in fieldtypes.items():
         # Convert the snake_case field name to PascalCase to match the JSON key
         json_field = field
-        if (pascal_case):
+        if pascal_case:
             json_field = snake_to_pascal(field)
 
         # Fetch the corresponding value from the JSON data