Skip to content

Commit 6e3da2c

Browse files
Merge branch 'feature/refactored-access-grant' into feature/deprecate-vault-admin-password
2 parents 0e92e29 + 52052ca commit 6e3da2c

6 files changed

Lines changed: 52 additions & 51 deletions

File tree

backend/src/main/resources/application.properties

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ hub.keycloak.oidc.cryptomator-client-id=cryptomator
3232
%dev.quarkus.keycloak.devservices.realm-name=cryptomator
3333
%dev.quarkus.keycloak.devservices.port=8180
3434
%dev.quarkus.keycloak.devservices.service-name=quarkus-cryptomator-hub
35-
%dev.quarkus.keycloak.devservices.image-name=ghcr.io/cryptomator/keycloak:21.1.2
35+
%dev.quarkus.keycloak.devservices.image-name=ghcr.io/cryptomator/keycloak:22.0.1
3636
%dev.quarkus.oidc.devui.grant.type=code
3737
# OIDC will be mocked during unit tests. Use fake auth url to prevent dev services to start:
3838
%test.quarkus.oidc.auth-server-url=http://localhost:43210/dev/null

frontend/package-lock.json

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

frontend/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
"file-saver": "^2.0.5",
5656
"jdenticon": "^3.2.0",
5757
"jszip": "^3.10.1",
58-
"keycloak-js": "^21.1.2",
58+
"keycloak-js": "^22.0.1",
5959
"miscreant": "^0.3.2",
6060
"rfc4648": "^1.5.2",
6161
"semver": "^7.5.3",

frontend/src/common/jwe.ts

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ export class ConcatKDF {
3737
export type JWEHeader = {
3838
readonly alg: 'ECDH-ES' | 'PBES2-HS512+A256KW',
3939
readonly enc: 'A256GCM' | 'A128GCM',
40-
readonly apu: string,
41-
readonly apv: string,
40+
readonly apu?: string,
41+
readonly apv?: string,
4242
readonly epk?: JsonWebKey,
4343
readonly p2c?: number,
4444
readonly p2s?: string
@@ -213,8 +213,8 @@ export class ECDH_ES {
213213
let derivedKey = new Uint8Array();
214214
try {
215215
const algorithmId = ECDH_ES.lengthPrefixed(new TextEncoder().encode(header.enc));
216-
const partyUInfo = ECDH_ES.lengthPrefixed(base64url.parse(header.apu, { loose: true }));
217-
const partyVInfo = ECDH_ES.lengthPrefixed(base64url.parse(header.apv, { loose: true }));
216+
const partyUInfo = ECDH_ES.lengthPrefixed(base64url.parse(header.apu || '', { loose: true }));
217+
const partyVInfo = ECDH_ES.lengthPrefixed(base64url.parse(header.apv || '', { loose: true }));
218218
const suppPubInfo = new ArrayBuffer(4);
219219
new DataView(suppPubInfo).setUint32(0, desiredKeyBytes * 8, false);
220220
agreedKey = new Uint8Array(await crypto.subtle.deriveBits(

frontend/test/common/jwe.spec.ts

Lines changed: 40 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -91,48 +91,36 @@ describe('JWE', () => {
9191
});
9292

9393
describe('ECDH_ES', () => {
94-
/**
95-
* Test vectors from https://www.rfc-editor.org/rfc/rfc7518#appendix-C
96-
*/
97-
it('should derive expected key using ECDH-ES', async () => {
98-
const alicePub: JsonWebKey = {
99-
kty: 'EC',
100-
crv: 'P-256',
101-
x: 'gI0GAILBdu7T53akrFmMyGcsF3n5dO7MmwNBHKW5SV0',
102-
y: 'SLW_xSffzlPWrHEVI30DHM_4egVwt3NQqeUD7nMFpps'
103-
};
104-
const alicePriv: JsonWebKey = {
105-
...alicePub,
106-
d: '0_NxaRPUMQoAJt50Gz8YiTr8gRTwyEaCumd-MToTmIo'
107-
};
108-
const alice = await crypto.subtle.importKey(
109-
'jwk',
110-
alicePriv,
111-
{
112-
name: 'ECDH',
113-
namedCurve: 'P-256'
114-
},
115-
false,
116-
['deriveBits']
117-
);
94+
// Test vectors from https://www.rfc-editor.org/rfc/rfc7518#appendix-C
95+
const alicePub: JsonWebKey = {
96+
kty: 'EC',
97+
crv: 'P-256',
98+
x: 'gI0GAILBdu7T53akrFmMyGcsF3n5dO7MmwNBHKW5SV0',
99+
y: 'SLW_xSffzlPWrHEVI30DHM_4egVwt3NQqeUD7nMFpps'
100+
};
101+
const alicePriv: JsonWebKey = {
102+
...alicePub,
103+
d: '0_NxaRPUMQoAJt50Gz8YiTr8gRTwyEaCumd-MToTmIo'
104+
};
105+
let alice: CryptoKey;
106+
const bobPub: JsonWebKey = {
107+
kty: 'EC',
108+
crv: 'P-256',
109+
x: 'weNJy2HscCSM6AEDTDg04biOvhFhyyWvOHQfeF_PxMQ',
110+
y: 'e8lnCO-AlStT-NJVX-crhB7QRYhiix03illJOVAOyck'
111+
};
112+
let bob: CryptoKey;
113+
114+
beforeEach(async () => {
115+
const importParams: EcKeyImportParams = { name: 'ECDH', namedCurve: 'P-256' };
116+
alice = await crypto.subtle.importKey('jwk', alicePriv, importParams, false, ['deriveBits']);
117+
bob = await crypto.subtle.importKey('jwk', bobPub, importParams, false, []);
118118
expect(alice.type, 'alice\'s key type').to.eql('private');
119-
const bob = await crypto.subtle.importKey(
120-
'jwk',
121-
{
122-
kty: 'EC',
123-
crv: 'P-256',
124-
x: 'weNJy2HscCSM6AEDTDg04biOvhFhyyWvOHQfeF_PxMQ',
125-
y: 'e8lnCO-AlStT-NJVX-crhB7QRYhiix03illJOVAOyck'
126-
},
127-
{
128-
name: 'ECDH',
129-
namedCurve: 'P-256'
130-
},
131-
false,
132-
[]
133-
);
134119
expect(bob.type, 'bob\'s key type').to.eql('public');
120+
});
135121

122+
it('should derive expected key using ECDH-ES', async () => {
123+
// Test vectors from https://www.rfc-editor.org/rfc/rfc7518#appendix-C
136124
const apu = new Uint8Array([65, 108, 105, 99, 101]);
137125
const apv = new Uint8Array([66, 111, 98]);
138126
const header: JWEHeader = {
@@ -146,5 +134,18 @@ describe('JWE', () => {
146134
const derivedBytes = await crypto.subtle.exportKey('raw', derived);
147135
expect(new Uint8Array(derivedBytes), 'derived key').to.eql(new Uint8Array([86, 170, 141, 234, 248, 35, 109, 32, 92, 34, 40, 205, 113, 167, 16, 26]));
148136
});
137+
138+
it('should derive content key despite missing apu/apv', async () => {
139+
const header: JWEHeader = {
140+
alg: 'ECDH-ES', // not relevant for this test
141+
enc: 'A128GCM',
142+
epk: alicePub,
143+
apu: undefined,
144+
apv: undefined
145+
};
146+
const derived = await ECDH_ES.deriveContentKey(bob, alice, 256, 16, header, true);
147+
const derivedBytes = await crypto.subtle.exportKey('raw', derived);
148+
expect(new Uint8Array(derivedBytes), 'derived key').to.eql(new Uint8Array([187, 151, 171, 93, 14, 133, 109, 143, 143, 192, 62, 38, 91, 36, 42, 125]));
149+
});
149150
});
150151
});

keycloak/Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM quay.io/keycloak/keycloak:21.1.2 as builder
1+
FROM quay.io/keycloak/keycloak:22.0.1 as builder
22
ENV KC_HEALTH_ENABLED=true
33
ENV KC_METRICS_ENABLED=true
44
ENV KC_HTTP_RELATIVE_PATH=/kc
@@ -11,7 +11,7 @@ FROM registry.access.redhat.com/ubi9 AS ubi-micro-build
1111
RUN mkdir -p /mnt/rootfs
1212
RUN dnf install --installroot /mnt/rootfs curl --releasever 9 --setopt install_weak_deps=false --nodocs -y; dnf --installroot /mnt/rootfs clean all
1313

14-
FROM quay.io/keycloak/keycloak:21.1.2
14+
FROM quay.io/keycloak/keycloak:22.0.1
1515
LABEL maintainer="info@skymatic.de"
1616
COPY --from=builder /opt/keycloak/ /opt/keycloak/
1717
COPY --from=ubi-micro-build /mnt/rootfs /

0 commit comments

Comments
 (0)