From d8063ed8e20348569f6e97938ef037942aecc97e Mon Sep 17 00:00:00 2001 From: Andy Caruso Date: Tue, 29 Mar 2022 10:33:22 -0700 Subject: [PATCH] Use the algorithm from the key object Signed-off-by: Andy Caruso --- plugins/auth-backend/src/identity/TokenFactory.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/plugins/auth-backend/src/identity/TokenFactory.ts b/plugins/auth-backend/src/identity/TokenFactory.ts index 3d49b30b6c..b72c3ef06d 100644 --- a/plugins/auth-backend/src/identity/TokenFactory.ts +++ b/plugins/auth-backend/src/identity/TokenFactory.ts @@ -20,6 +20,7 @@ import { Logger } from 'winston'; import { v4 as uuid } from 'uuid'; import { DateTime } from 'luxon'; import { parseEntityRef } from '@backstage/catalog-model'; +import { AuthenticationError } from '@backstage/errors'; const MS_IN_S = 1000; @@ -52,7 +53,6 @@ export class TokenFactory implements TokenIssuer { private readonly logger: Logger; private readonly keyStore: KeyStore; private readonly keyDurationSeconds: number; - private readonly alg = 'ES256'; private keyExpiry?: Date; private privateKeyPromise?: Promise; @@ -85,8 +85,12 @@ export class TokenFactory implements TokenIssuer { this.logger.info(`Issuing token for ${sub}, with entities ${ent ?? []}`); + if (!key.alg) { + throw new AuthenticationError('No algorithm was provided in the key'); + } + return new SignJWT({ iss, sub, aud, iat, exp }) - .setProtectedHeader({ alg: this.alg, kid: key.kid }) + .setProtectedHeader({ alg: key.alg, kid: key.kid }) .setIssuer(iss) .setAudience(aud) .setSubject(sub) @@ -152,11 +156,11 @@ export class TokenFactory implements TokenIssuer { .toJSDate(); const promise = (async () => { // This generates a new signing key to be used to sign tokens until the next key rotation - const key = await generateKeyPair(this.alg); + const key = await generateKeyPair('ES256'); const publicKey = await exportJWK(key.publicKey); const privateKey = await exportJWK(key.privateKey); publicKey.kid = privateKey.kid = uuid(); - publicKey.alg = privateKey.alg = this.alg; + publicKey.alg = privateKey.alg = 'ES256'; // We're not allowed to use the key until it has been successfully stored // TODO: some token verification implementations aggressively cache the list of keys, and