Develop Reference

Create decryption key from .pem for Azure AD SAML assertion

I'm implementing an integration that needs to authenticate with the SAML protocol.
Everything works fine without the Azure AD Token encryption but when it's active i'm unable to authenticate to the IdP.
I've got the .pem file used for the Token encryption but I can't find documentation on how to use this certificate.
I've tried to import the "encryption.pem" in my keystore that already contains the signing certificate and key that I use to sign the request and response (the certificates are different).
I think it does not work because the .pem file I have is a certificate and I think I need to generate a key pair from that cert.
Can someone point out how to do this with OpenSSL or also Java Keytool?
For more infos I'm posting my code that handles the keystore and the ExtendedMetadata bean where I'm trying to link the .pem certificate i got.
Resource storeFile = loader.getResource(keyStoreLocation);
String storePass = samlKeyStorePassword;
Map<String, String> passwords = new HashMap<>();
passwords.put(samlPrivateKeyAlias, samlPrivateKeyPassword);
String defaultKey = samlPrivateKeyAlias;
return new JKSKeyManager(storeFile, storePass, passwords, defaultKey);
// Setup advanced info about metadata
#Bean
public ExtendedMetadata extendedMetadata() {
ExtendedMetadata extendedMetadata = new ExtendedMetadata();
extendedMetadata.setIdpDiscoveryEnabled(false);
extendedMetadata.setSigningAlgorithm("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
extendedMetadata.setSignMetadata(true);
extendedMetadata.setEncryptionKey("enc"); //THIS IS WHERE I'M TRYING TO PUT MY ENCRYPTION KEY
extendedMetadata.setEcpEnabled(true);
return extendedMetadata;
} ```

JWT Introspection middleware with a Web API - Java and Identity Server

I am currently using Identity Server 4 which is .Net Core based to issue JWT tokens. I have a .Net Core web api that has middleware in order for the JWT to be validated in the Startup.cs:
services.AddAuthentication("Bearer")
.AddJwtBearer("Bearer", options =>
{
options.Authority = "http://localhost:5005";
options.Audience = "api1";
});
As we can see, its not asking for much except the location of the token server and who the api is which is `api1. Obviously, its doing some more complex things under the hood.
I found a Java based equivalent to the middleware above, which validates a JWT:
String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXUyJ9.eyJpc3MiOiJhdXRoMCJ9.AbIJTDMFc7yUa5MhvcP03nJPyCPzZtQcGEp-zWfOkEE";
RSAPublicKey publicKey = //Get the key instance
RSAPrivateKey privateKey = //Get the key instance
try {
Algorithm algorithm = Algorithm.RSA256(publicKey, privateKey);
JWTVerifier verifier = JWT.require(algorithm)
.withIssuer("auth0")
.build(); //Reusable verifier instance
DecodedJWT jwt = verifier.verify(token);
} catch (JWTVerificationException exception){
//Invalid signature/claims
}
This is from HERE as was recommended by the jwt.io site.
Basically I want to be able to implement something in Java that is doing the same thing as the .Net Core code above, but its clearly asking for things like a Public and Private key that I have no idea how to provide at this point, as the JWT is coming through the header of the request.

Under the hood, the Microsoft JWT middleware is going to IdentityServer's discovery endpoint and loading in configuration such as the issuer and JWKS (public keys). The discovery document is always hosted on /.well-known/openid-configuration.
To validate the token, you will at least need the public keys from the JWKS. In the past I've loaded it it using the jwks-rsa library: https://www.scottbrady91.com/Kotlin/JSON-Web-Token-Verification-in-Ktor-using-Kotlin-and-Java-JWT
When validating the access token, as a minimum, you'll also need to check the token's audience (is the token intended for you) and if it has expired.

etoken unaccessible after reading

I´m trying to read out the certificate of an etoken. I´ve followed the answer from Keystore from digital signature e-token using java. It´s giving me the certificates installed in the token but after that the token isn´t reachable anymore. Did somebody got something similar while accessing a token?
// Create instance of SunPKCS11 provider
String pkcs11Config = "name=eToken\nlibrary=C:\\path\\to\\your\\pkcs11.dll";
java.io.ByteArrayInputStream pkcs11ConfigStream = new java.io.ByteArrayInputStream(pkcs11Config.getBytes());
sun.security.pkcs11.SunPKCS11 providerPKCS11 = new sun.security.pkcs11.SunPKCS11(pkcs11ConfigStream);
java.security.Security.addProvider(providerPKCS11); // Get provider KeyStore and login with PIN String pin = "11111111";
java.security.KeyStore keyStore = java.security.KeyStore.getInstance("PKCS11", providerPKCS11);
keyStore.load(null, pin.toCharArray()); // Enumerate items (certificates and private keys) in the KeyStore
java.util.Enumeration<String> aliases = keyStore.aliases();
while (aliases.hasMoreElements()) {
String alias = aliases.nextElement();
System.out.println(alias);
}
The problem persists, after plugging out/in the token is reachable again, but after running the code, the token seems to be locked again. OS Win2k8 Server.

Finally got this clear. After disconnecting other USB devices the Token responds as usual.
The Token should be plugged in to a fully powered port. Best on a separate Host- Bus.

How to add new password Attribute with Apache LDAP API

I am using Apache LDAP API to set new attribute: userPassword in Oracle Internet Directory. I want to set this password with SHA encryption method. I currently have following code:
Attribute userPasswordAttribute = new DefaultAttribute("userPassword", "password"));
ModifyRequest modifyRequest = new ModifyRequestImpl();
modifyRequest.setName(dn);
modifyRequest.add(userPasswordAttribute);
ModifyResponse response = connection.modify(modifyRequest);
However this adds SSHA encrypted password along with some other attributes which I do not want (authpassword;oid). I have seen that there a class called EncryptionMethod in LDAP API but how to use it in my code?

Try this
String newPassword = "password";
modifyRequest.replace("userPassword", PasswordUtil.createStoragePassword(
newPassword.getBytes(), LdapSecurityConstants.HASH_METHOD_SHA));

get user info from a client certificate in a java web service context

I'm developing a java web service, with client certificate security enabled.
I don't want to add a parameter to each method with a user ID. Since the user is already authenticating through the soap header with his client certificate, is it possible to fetch the user data (common name, email, etc) from his certificate?
Thanks!

This is how you can retrieve DN from the request,
Object certChain = request.getAttribute(
"javax.servlet.request.X509Certificate");
if (certChain != null) {
X509Certificate certs[] = (X509Certificate[])certChain;
X509Certificate cert = certs[0];
String n = cert.getSubjectDN().getName();
}
For this to work, you have to configure the HTTPS connector properly. If AJP is used, you have to configure the AJP connector so the certificate is passed from Apache to Tomcat.

Cast your java.security.cert.Certificate to java.security.cert.X509Certificate and check the methods you have available on it - like getSubjectDN()