-
Notifications
You must be signed in to change notification settings - Fork 24
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Allow JWTs signed with RS256 asymmetric keys. #4
Open
dmunch
wants to merge
23
commits into
softapalvelin:master
Choose a base branch
from
dmunch:master
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…of creating JWK on reach request.
… clearly see the gen_server bottleneck here which could be easily fixed by not doing the actual decoding in the gen_server but by using it only for the state.
…istically start and stop gen_server for each test in functions setup/0 and cleanup/0
…jwt_auth tries to download the public key from the opened configuration url.
…. Handle that case by taking the first key always for now.
…tory commit where only one RS256 key can be used.
… returns the complete list of keys from the url.
…o load it from the openid_authority. This is the way described in 10.1.1. Rotation of Asymmetric Signing Keys of the OpenID Connect 1.0 spec.
We're using those modifications in production now and I think the implementation is pretty complete and tested. Once again it was my first project in Erlang used in production, so I would be happy about review and corrections. And even more happy if that pull request would be accepted! |
…there where changes to the return value of peek_protected.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR enables verification of JWTs signed with the RS256 algorithm. Since
ejwt
only implements HS256 the first step was to use the JWT libraryjose
instead ofejwt
. In the second step I added the verification with the RS256 public key. The public key is configured by a new enty int he .ini file calledrs_public_key
and must be given in PEM format. I added tests also for the edge case wherehs_secret
andrs_public_key
are set at the same time.Open questions:
jose
which aren't always the same as the exceptions ofejwt
. I don't think it's a big problem since there's a big try/catch injwt_authentication_handler
, but I'd like to have a confirmation on that.This is my very first pull request for CouchDB in general and in Erlang in particular, so I'd be more than happy for reviews, suggestions and possible improvements.
Thanks in advance,
Daniel