We are doing different & need help. May be a call (if possible/email exchange) or some sort of way where we can discuss to resolve the issue. It is 1 step to close it but not able to identify what is the root cause. Tried different valid keys combination but it still fails to validate.
For Creation, we pass below properties & produce a detached JWS (which has critical params).
==
String jsonClaim = “{"id":1234,"verified":true,"allocations":[4,"seven",false]}”;
Map properties = new HashMap();
properties.put(“issuer”, “XX1XX”);
properties.put(“audience”, “XXXX2X”);
properties.put(“subject”, “XXXX2”);
properties.put(“algorithm”, “PS256”);
properties.put(“debug”, “true”);
properties.put(“private-key”, privateKeyMap.get(“rsa-private-3”));
properties.put(“private-key-password”, “XXXX”);
properties.put(“expiresIn”, “300”); // seconds
properties.put(“jti”, jti);
properties.put(“kid”, “XXXXXX”);
properties.put(“claim_json_account”, jsonClaim);
For Validating by passing detached JWS & same jsonClaim/payload to validate the signature.
String jsonClaim = “{"id":1234,"verified":true,"allocations":[4,"seven",false]}”;
Map properties = new HashMap();
properties.put(“algorithm”, “PS256”);
properties.put(“jwt”, jwtMap.get(“ms3”));
properties.put(“payload”, jsonClaim);
properties.put(“jwksUri”, “https://test.aaaa.com/v1/test/jwks.jwks”);
0> Recieve the detached JWS + payload & reattach with all 3 parts to produce JWS.
1> Get Header,Kid,validate alg
2> Get & validate public Key (Providing JWKS,KID & extracting the x5c from jwks url & constructing the certificate)
3> Pass pub key with headers & critical params to verify
4> We see issues during the verification at step 3.
JWSVerifier jwsVerifier = new RSASSAVerifier(pubKey,jwsObject.getHeader().getCriticalParams());
if (jwsObject.verify(jwsVerifier)) {
verified = true;
msgCtxt.setVariable(varName(“verified”), “true”);
} else {
msgCtxt.setVariable(varName(“verified”), “false”);
You have the zip file which has the code for reference.
==
Update:
Looks like two possibilities with the test.It is appending = which it is generating…
- payload padding issue (=)
Below payload part is causing issues
private String reattachJws(String detachedJws, String unencodedPayload) {
String[] jwsParts = StringUtils.split(detachedJws, ".");
byte[] encodedPayload = Base64.getEncoder().encode(unencodedPayload.getBytes());
return jwsParts[0] + "." + new String(encodedPayload)+ "." + jwsParts[1];
}
==
Base64url Encoding Base64 encoding using the URL- and filename-safe character set defined in Section 5 of RFC 4648 [RFC4648], with all trailing ‘=’ characters omitted (as permitted by Section 3.2) and without the inclusion of any line breaks, whitespace, or other additional characters. Note that the base64url encoding of the empty octet sequence is the empty string. (See Appendix C for notes on implementing base64url encoding without padding.)
==
2.critical params
Need to investigate why adding crit params cause an issue..
-Vinay