Details
-
Improvement
-
Status: Closed
-
Major
-
Resolution: Fixed
-
None
-
None
-
None
Description
Right now, the Knox SSO and Token services can only issue tokens signed with RS256. This task is to support a wider range of signature algorithms.
The following changes are proposed:
a) The Knox Token Service has a new configuration parameter "knox.token.sigalg" which defaults to "RS256".
b) The Knox SSO Service has a new configuration parameter "knoxsso.token.sigalg" which defaults to "RS256".
c) The DefaultTokenAuthorityService checks the signing algorithm against a pre-defined list, which is all of the RSA algorithms (RS* and PS*) from the JWA spec.
d) The JWTFederationFilter + the SSOCookieFederationFilter have a new configuration parameter "jwt.expected.sigalg" which defaults to "RS256". The received token must be signed with the algorithm that is configured for this value.