From 07654016d3665a57e72a0ed63a54f109f3e3b378 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Oct 27 2016 14:40:49 +0000
Subject: [PATCH 1/2] Re-add request_object_signing_alg client metadata


Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

---

diff --git a/ipsilon/providers/openidc/provider.py b/ipsilon/providers/openidc/provider.py
index 4c415d2..7a74257 100644
--- a/ipsilon/providers/openidc/provider.py
+++ b/ipsilon/providers/openidc/provider.py
@@ -4,7 +4,7 @@ from ipsilon.providers.openidc.api import APIError, APIRequest
 from ipsilon.util.security import generate_random_secure_string
 import ipsilon.util.config as pconfig
 
-
+from jwcrypto.jws import default_allowed_algs as jws_default_allowed_algs
 import cherrypy
 import json
 import time
@@ -228,6 +228,8 @@ class Client(pconfig.ConfigHelper):
                 return '*Autogenerated*'
         elif option == 'default_max_age':
             return 0
+        elif option == 'request_object_signing_alg':
+            return 'none'
         else:
             return ''
 
@@ -345,6 +347,12 @@ class Client(pconfig.ConfigHelper):
                 ['RS256'],
                 self.get_current_info('id_token_signed_response_alg'),
                 readonly=self.readonly),
+            pconfig.Pick(
+                'Request Object Signing Alg',
+                'Algorithm used to sign request objects',
+                jws_default_allowed_algs + ['none'],
+                self.get_current_info('request_object_signing_alg'),
+                readonly=self.readonly),
             pconfig.String(
                 'Initiate Login URI',
                 'URI that third party can use to initiate login at client.',
@@ -366,7 +374,6 @@ class Client(pconfig.ConfigHelper):
             # userinfo_signed_response_alg
             # userinfo_encrypted_response_alg
             # userinfo_encrypted_response_enc
-            # request_object_signing_alg (defualt none)
             # request_object_encryption_alg
             # request_object_encryption_enc
             # token_endpoint_auth_signing_alg

From dca4bbaccebc95c80f55027b3f927edf3622a9a1 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Oct 27 2016 14:41:50 +0000
Subject: [PATCH 2/2] Fix indentation on OIDC signed request objects code


Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

---

diff --git a/ipsilon/providers/openidc/auth.py b/ipsilon/providers/openidc/auth.py
index 28e1dde..a52a730 100644
--- a/ipsilon/providers/openidc/auth.py
+++ b/ipsilon/providers/openidc/auth.py
@@ -237,21 +237,21 @@ class Authorization(AuthenticateRequest):
                         raise Exception('Invalid algorithm used: %s'
                                         % decoded.token.jose_header['alg'])
 
-                    if client['request_object_signing_alg'] == 'none':
-                        jwt_request = json.loads(
-                            decoded.token.objects['payload'])
+                if client['request_object_signing_alg'] == 'none':
+                    jwt_request = json.loads(
+                        decoded.token.objects['payload'])
+                else:
+                    keyset = None
+                    if client['jwks']:
+                        keys = json.loads(client['jkws'])
                     else:
-                        keyset = None
-                        if client['jwks']:
-                            keys = json.loads(client['jkws'])
-                        else:
-                            keys = requests.get(client['jwks_uri']).json()
-                        keyset = JWKSet()
-                        for key in keys['keys']:
-                            keyset.add(JWK(**key))
-                        key = keyset.get_key(decoded.token.jose_header['kid'])
-                        decoded = JWT(jwt=jwt_object, key=key)
-                        jwt_request = json.loads(decoded.claims)
+                        keys = requests.get(client['jwks_uri']).json()
+                    keyset = JWKSet()
+                    for key in keys['keys']:
+                        keyset.add(JWK(**key))
+                    key = keyset.get_key(decoded.token.jose_header['kid'])
+                    decoded = JWT(jwt=jwt_object, key=key)
+                    jwt_request = json.loads(decoded.claims)
 
             except Exception as ex:  # pylint: disable=broad-except
                 self.debug('Unable to parse request: %s' % ex)

