Add manager option for userinfo signature alg (#2547)

4 years ago · 4aa9edb2cc
parent bdeb1e70d9
commit 4aa9edb2cc
18 changed files with 116 additions and 12 deletions
--- a/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/ReConstants.pm
+++ b/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/ReConstants.pm
@ -27,7 +27,7 @@ our $specialNodeKeys = '(?:(?:(?:saml(?:ID|S)|oidc[OR])P|cas(?:App|Srv))MetaData
 our $casAppMetaDataNodeKeys = 'casAppMetaData(?:Options(?:(?:UserAttribut|Servic|Rul)e|AuthnLevel)|(?:ExportedVar|Macro)s)';
 our $casSrvMetaDataNodeKeys = 'casSrvMetaData(?:Options(?:ProxiedServices|DisplayName|SortNumber|Gateway|Renew|Icon|Url)|ExportedVars)';
 our $oidcOPMetaDataNodeKeys = 'oidcOPMetaData(?:Options(?:C(?:lient(?:Secret|ID)|heckJWTSignature|onfigurationURI)|S(?:toreIDToken|ortNumber|cope)|TokenEndpointAuthMethod|(?:JWKSTimeou|Promp)t|I(?:DTokenMaxAge|con)|U(?:iLocales|seNonce)|Display(?:Name)?|AcrValues|MaxAge)|ExportedVars|J(?:SON|WKS))';
-our $oidcRPMetaDataNodeKeys = 'oidcRPMetaData(?:Options(?:A(?:llow(?:(?:ClientCredentials|Password)Grant|Offline)|ccessToken(?:Expiration|SignAlg|Claims|JWT)|uth(?:orizationCodeExpiration|nLevel)|dditionalAudiences)|I(?:DToken(?:ForceClaims|Expiration|SignAlg)|con)|R(?:e(?:directUris|freshToken|quirePKCE)|ule)|Logout(?:SessionRequired|Type|Url)|P(?:ostLogoutRedirectUris|ublic)|OfflineSessionExpiration|Client(?:Secret|ID)|BypassConsent|DisplayName|ExtraClaims|UserIDAttr)|(?:ExportedVar|ScopeRule|Macro)s)';
+our $oidcRPMetaDataNodeKeys = 'oidcRPMetaData(?:Options(?:A(?:llow(?:(?:ClientCredentials|Password)Grant|Offline)|ccessToken(?:Expiration|SignAlg|Claims|JWT)|uth(?:orizationCodeExpiration|nLevel)|dditionalAudiences)|I(?:DToken(?:ForceClaims|Expiration|SignAlg)|con)|R(?:e(?:directUris|freshToken|quirePKCE)|ule)|Logout(?:SessionRequired|Type|Url)|P(?:ostLogoutRedirectUris|ublic)|UserI(?:nfoSignAlg|DAttr)|OfflineSessionExpiration|Client(?:Secret|ID)|BypassConsent|DisplayName|ExtraClaims)|(?:ExportedVar|ScopeRule|Macro)s)';
 our $samlIDPMetaDataNodeKeys = 'samlIDPMetaData(?:Options(?:(?:Check(?:S[LS]OMessageSignatur|Audienc|Tim)|EncryptionMod|UserAttribut|DisplayNam)e|S(?:ign(?:S[LS]OMessage|atureMethod)|toreSAMLToken|[LS]OBinding|ortNumber)|A(?:llow(?:LoginFromIDP|ProxiedAuthn)|daptSessionUtime)|Re(?:questedAuthnContext|solutionRule|layStateURL)|Force(?:Authn|UTF8)|I(?:sPassive|con)|NameIDFormat)|ExportedAttributes|XML)';
 our $samlSPMetaDataNodeKeys = 'samlSPMetaData(?:Options(?:S(?:ign(?:S[LS]OMessage|atureMethod)|essionNotOnOrAfterTimeout)|N(?:ameID(?:SessionKey|Format)|otOnOrAfterTimeout)|(?:CheckS[LS]OMessageSignatur|OneTimeUs|Rul)e|En(?:ableIDPInitiatedURL|cryptionMode)|AuthnLevel|ForceUTF8)|(?:ExportedAttribute|Macro)s|XML)';
 our $virtualHostKeys = '(?:vhost(?:A(?:ccessToTrace|uthnLevel|liases)|(?:Maintenanc|Typ)e|ServiceTokenTTL|Https|Port)|(?:exportedHeader|locationRule)s|post)';
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm
@ -2449,6 +2449,43 @@ m[^(?:ldapi://[^/]*/?|\w[\w\-\.]*(?::\d{1,5})?|ldap(?:s|\+tls)?://\w[\w\-\.]*(?:
        'oidcRPMetaDataOptionsUserIDAttr' => {
            'type' => 'text'
        },
+        'oidcRPMetaDataOptionsUserInfoSignAlg' => {
+            'default' => '',
+            'select'  => [ {
+                    'k' => '',
+                    'v' => ''
+                },
+                {
+                    'k' => 'none',
+                    'v' => 'None'
+                },
+                {
+                    'k' => 'HS256',
+                    'v' => 'HS256'
+                },
+                {
+                    'k' => 'HS384',
+                    'v' => 'HS384'
+                },
+                {
+                    'k' => 'HS512',
+                    'v' => 'HS512'
+                },
+                {
+                    'k' => 'RS256',
+                    'v' => 'RS256'
+                },
+                {
+                    'k' => 'RS384',
+                    'v' => 'RS384'
+                },
+                {
+                    'k' => 'RS512',
+                    'v' => 'RS512'
+                }
+            ],
+            'type' => 'select'
+        },
        'oidcRPMetaDataScopeRules' => {
            'default' => {},
            'test'    => {
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Attributes.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Attributes.pm
@ -4252,6 +4252,20 @@ m{^(?:ldapi://[^/]*/?|\w[\w\-\.]*(?::\d{1,5})?|ldap(?:s|\+tls)?://\w[\w\-\.]*(?:
            ],
            default => 'RS256',
        },
+        oidcRPMetaDataOptionsUserInfoSignAlg => {
+            type   => 'select',
+            select => [
+                { k => '',  v => '' },
+                { k => 'none',  v => 'None' },
+                { k => 'HS256', v => 'HS256' },
+                { k => 'HS384', v => 'HS384' },
+                { k => 'HS512', v => 'HS512' },
+                { k => 'RS256', v => 'RS256' },
+                { k => 'RS384', v => 'RS384' },
+                { k => 'RS512', v => 'RS512' },
+            ],
+            default => '',
+        },
        oidcRPMetaDataOptionsAccessTokenJWT => { type => 'bool', default => 0 },
        oidcRPMetaDataOptionsAccessTokenClaims =>
          { type => 'bool', default => 0 },
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/CTrees.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/CTrees.pm
@ -224,6 +224,7 @@ sub cTrees {
                        nodes => [
                            'oidcRPMetaDataOptionsIDTokenSignAlg',
                            'oidcRPMetaDataOptionsAccessTokenSignAlg',
+                            'oidcRPMetaDataOptionsUserInfoSignAlg',
                            'oidcRPMetaDataOptionsRequirePKCE',
                            'oidcRPMetaDataOptionsAllowOffline',
                            'oidcRPMetaDataOptionsAllowPasswordGrant',
--- a/lemonldap-ng-manager/site/htdocs/static/js/conftree.js
+++ b/lemonldap-ng-manager/site/htdocs/static/js/conftree.js
@ -567,6 +567,47 @@ function templates(tpl,key) {
                  "title" : "oidcRPMetaDataOptionsAccessTokenSignAlg",
                  "type" : "select"
               },
+               {
+                  "default" : "",
+                  "get" : tpl+"s/"+key+"/"+"oidcRPMetaDataOptionsUserInfoSignAlg",
+                  "id" : tpl+"s/"+key+"/"+"oidcRPMetaDataOptionsUserInfoSignAlg",
+                  "select" : [
+                     {
+                        "k" : "",
+                        "v" : ""
+                     },
+                     {
+                        "k" : "none",
+                        "v" : "None"
+                     },
+                     {
+                        "k" : "HS256",
+                        "v" : "HS256"
+                     },
+                     {
+                        "k" : "HS384",
+                        "v" : "HS384"
+                     },
+                     {
+                        "k" : "HS512",
+                        "v" : "HS512"
+                     },
+                     {
+                        "k" : "RS256",
+                        "v" : "RS256"
+                     },
+                     {
+                        "k" : "RS384",
+                        "v" : "RS384"
+                     },
+                     {
+                        "k" : "RS512",
+                        "v" : "RS512"
+                     }
+                  ],
+                  "title" : "oidcRPMetaDataOptionsUserInfoSignAlg",
+                  "type" : "select"
+               },
               {
                  "default" : 0,
                  "get" : tpl+"s/"+key+"/"+"oidcRPMetaDataOptionsRequirePKCE",
--- a/lemonldap-ng-manager/site/htdocs/static/js/conftree.min.js
+++ b/lemonldap-ng-manager/site/htdocs/static/js/conftree.min.js
--- a/lemonldap-ng-manager/site/htdocs/static/js/conftree.min.js.map
+++ b/lemonldap-ng-manager/site/htdocs/static/js/conftree.min.js.map
--- a/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"قاعدة الدخول",
 "oidcRPMetaDataOptionsTimeouts":"Timeouts",
 "oidcRPMetaDataOptionsUserIDAttr":"خاصّيّة المستخدم",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Scope rules",
 "oidcRPName":"اسم أوبين أيدي كونيكت RP",
 "oidcRPStateTimeout":"حالة مهلة الجلسة",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/de.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/de.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"Access rule",
 "oidcRPMetaDataOptionsTimeouts":"Timeouts",
 "oidcRPMetaDataOptionsUserIDAttr":"User attribute",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Scope rules",
 "oidcRPName":"OpenID Connect RP Name",
 "oidcRPStateTimeout":"State session timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/en.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/en.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"Access rule",
 "oidcRPMetaDataOptionsTimeouts":"Timeouts",
 "oidcRPMetaDataOptionsUserIDAttr":"User attribute",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Scope rules",
 "oidcRPName":"OpenID Connect RP Name",
 "oidcRPStateTimeout":"State session timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/es.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/es.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"Regla de acceso",
 "oidcRPMetaDataOptionsTimeouts":"Timeouts",
 "oidcRPMetaDataOptionsUserIDAttr":"Atributo de usuario",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Scope rules",
 "oidcRPName":"OpenID Connect RP Name",
 "oidcRPStateTimeout":"Caducidad de estado de sesión",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/fr.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/fr.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"Règle d'accès",
 "oidcRPMetaDataOptionsTimeouts":"Expiration",
 "oidcRPMetaDataOptionsUserIDAttr":"Attribut de l'utilisateur",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Algorithme de signature des informations utilisateur",
 "oidcRPMetaDataScopeRules":"Règles de scope",
 "oidcRPName":"Nom du client OpenID Connect",
 "oidcRPStateTimeout":"Durée d'une session state",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/it.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/it.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"Regola di accesso",
 "oidcRPMetaDataOptionsTimeouts":"Timeouts",
 "oidcRPMetaDataOptionsUserIDAttr":"Attributo utente",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Scope rules",
 "oidcRPName":"Nome di OpenID Connect RP",
 "oidcRPStateTimeout":"Durata della sessione stato",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"Reguła dostępu",
 "oidcRPMetaDataOptionsTimeouts":"Limit czasu",
 "oidcRPMetaDataOptionsUserIDAttr":"Atrybut użytkownika",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Zasady dotyczące zakresu",
 "oidcRPName":"Nazwa RP OpenID Connect",
 "oidcRPStateTimeout":"Limit czasu sesji stanowej",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"Erişim kuralı",
 "oidcRPMetaDataOptionsTimeouts":"Zaman aşımları",
 "oidcRPMetaDataOptionsUserIDAttr":"Kullanıcı niteliği",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Kapsam kuralları",
 "oidcRPName":"OpenID Connect RP Adı",
 "oidcRPStateTimeout":"Oturum zaman aşımını belirle",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"Quy tắc truy cập",
 "oidcRPMetaDataOptionsTimeouts":"Timeouts",
 "oidcRPMetaDataOptionsUserIDAttr":"thuộc tính người dùng",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Scope rules",
 "oidcRPName":"OpenID Connect RP Name",
 "oidcRPStateTimeout":"Thời gian chờ của trạng thái phiên làm việc",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"Access rule",
 "oidcRPMetaDataOptionsTimeouts":"Timeouts",
 "oidcRPMetaDataOptionsUserIDAttr":"User attribute",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Scope rules",
 "oidcRPName":"OpenID Connect RP Name",
 "oidcRPStateTimeout":"State session timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
@ -686,6 +686,7 @@
 "oidcRPMetaDataOptionsRule":"存取規則",
 "oidcRPMetaDataOptionsTimeouts":"逾時",
 "oidcRPMetaDataOptionsUserIDAttr":"使用者屬性",
+"oidcRPMetaDataOptionsUserInfoSignAlg":"Userinfo signature algorithm",
 "oidcRPMetaDataScopeRules":"Scope rules",
 "oidcRPName":"OpenID 連線 RP 名稱",
 "oidcRPStateTimeout":"狀態工作階段逾時",