Expose the public keys used for client authentication on an endpoint

This commit is contained in:
Quentin Gliech 2023-05-16 15:36:40 +02:00 committed by Patrick Cloke
parent 765244faee
commit 8f576aa462
2 changed files with 78 additions and 0 deletions

View File

@ -46,6 +46,12 @@ def build_synapse_client_resource_tree(hs: "HomeServer") -> Mapping[str, Resourc
"/_synapse/client/unsubscribe": UnsubscribeResource(hs),
}
# Expose the JWKS endpoint if OAuth2 delegation is enabled
if hs.config.auth.oauth_delegation_enabled:
from synapse.rest.synapse.client.jwks import JwksResource
resources["/_synapse/jwks"] = JwksResource(hs)
# provider-specific SSO bits. Only load these if they are enabled, since they
# rely on optional dependencies.
if hs.config.oidc.oidc_enabled:

View File

@ -0,0 +1,72 @@
# Copyright 2022 The Matrix.org Foundation C.I.C.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
import logging
from typing import TYPE_CHECKING, Tuple
from synapse.http.server import DirectServeJsonResource
from synapse.http.site import SynapseRequest
from synapse.types import JsonDict
if TYPE_CHECKING:
from synapse.server import HomeServer
logger = logging.getLogger(__name__)
class JwksResource(DirectServeJsonResource):
def __init__(self, hs: "HomeServer"):
from authlib.jose.rfc7517 import Key
super().__init__(extract_context=True)
# Parameters that are allowed to be exposed in the public key.
# This is done manually, because authlib's private to public key conversion
# is unreliable depending on the version. Instead, we just serialize the private
# key and only keep the public parameters.
# List from https://www.iana.org/assignments/jose/jose.xhtml#web-key-parameters
public_parameters = {
"kty",
"use",
"key_ops",
"alg",
"kid",
"x5u",
"x5c",
"x5t",
"x5t#S256",
"crv",
"x",
"y",
"n",
"e",
"ext",
}
secret = hs.config.auth.oauth_delegation_client_secret
if isinstance(secret, Key):
private_key = secret.as_dict()
public_key = {
k: v for k, v in private_key.items() if k in public_parameters
}
keys = [public_key]
else:
keys = []
self.res = {
"keys": keys,
}
async def _async_render_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
return 200, self.res