diff --git a/classes/JWKSHandler.php b/classes/JWKSHandler.php index feffd906d1ac26d6c27e3ae528ffcf8461773efb..34a888dc8a4aafe2201e62289665e628002830db 100644 --- a/classes/JWKSHandler.php +++ b/classes/JWKSHandler.php @@ -15,7 +15,7 @@ class JWKSHandler { $this->locator = $locator; } - public function generateKeyPair() { + public function generateKeyPair(): RSAKeyPair { $rsa = new RSA(); diff --git a/classes/TokenBuilder.php b/classes/TokenBuilder.php index 64ae0f1c6578240a539c78acaab7eb0ab37dd8c1..a09ea3a2b89aefc159e8830af9fc87e4400c1734 100644 --- a/classes/TokenBuilder.php +++ b/classes/TokenBuilder.php @@ -14,7 +14,7 @@ class TokenBuilder { public function getIdToken(AccessTokenData $tokenData, \Closure $jwtCustomizer = null): string { - $keyPair = $this->locator->getJWKSDAO()->getNewestKeyPair(); + $keyPair = $this->getNewestKeyPair(); $payload = $this->createIdTokenPayloadArray($tokenData, $jwtCustomizer); @@ -30,10 +30,14 @@ class TokenBuilder { 'sub' => strval($user->id), 'iat' => intval($tokenData->creationTime), 'exp' => intval($tokenData->expirationTime), - 'name' => $user->getCompleteName(), 'aud' => $tokenData->clientId ); + $name = $user->getCompleteName(); + if ($name !== null) { + $payloadArr['name'] = $name; + } + if (in_array("email", $tokenData->scope)) { $payloadArr['email'] = $user->getPrimaryEmail(); } @@ -55,7 +59,7 @@ class TokenBuilder { public function getAccessToken(AccessTokenData $tokenData, \Closure $jwtCustomizer = null): string { - $keyPair = $this->locator->getJWKSDAO()->getNewestKeyPair(); + $keyPair = $this->getNewestKeyPair(); $user = $this->locator->getUserDAO()->findUserById($tokenData->userId); if ($user === null) { @@ -137,7 +141,7 @@ class TokenBuilder { $payload['exp'] = $iat + 3600; } - $keyPair = $this->locator->getJWKSDAO()->getNewestKeyPair(); + $keyPair = $this->getNewestKeyPair(); return JWT::encode($payload, $keyPair->privateKey, $keyPair->alg, $keyPair->keyId); } @@ -146,7 +150,7 @@ class TokenBuilder { * @param string $audience target service */ public function generateNewToken(string $subject, int $lifespan, string $audience) { - $keyPair = $this->locator->getJWKSDAO()->getNewestKeyPair(); + $keyPair = $this->getNewestKeyPair(); $iat = time(); $exp = $iat + $lifespan * 3600; @@ -179,4 +183,15 @@ class TokenBuilder { throw new \Exception("Unable to find configuration for " . $audience); } + private function getNewestKeyPair(): RSAKeyPair { + + $keyPair = $this->locator->getJWKSDAO()->getNewestKeyPair(); + + if ($keyPair === null) { + $keyPair = $this->locator->getJWKSHandler()->generateKeyPair(); + } + + return $keyPair; + } + } diff --git a/classes/datalayer/mysql/MySQLJWKSDAO.php b/classes/datalayer/mysql/MySQLJWKSDAO.php index 8e7a83ad188340b257950396055f12ceee49ec17..53724829b47fabbf452180f32757b05ac5c22cf0 100644 --- a/classes/datalayer/mysql/MySQLJWKSDAO.php +++ b/classes/datalayer/mysql/MySQLJWKSDAO.php @@ -12,13 +12,16 @@ class MySQLJWKSDAO extends BaseMySQLDAO implements JWKSDAO { $dbh = $this->getDBHandler(); - $query = "INSERT INTO rsa_keypairs(id, private_key, public_key, alg) VALUES (:id, :private_key, :public_key, :alg)"; + $query = "INSERT INTO rsa_keypairs(id, private_key, public_key, alg, creation_time) VALUES (:id, :private_key, :public_key, :alg, :creation_time)"; + $now = time(); + $stmt = $dbh->prepare($query); $stmt->bindParam(':id', $keyPair->keyId); $stmt->bindParam(':private_key', $keyPair->privateKey); $stmt->bindParam(':public_key', $keyPair->publicKey); $stmt->bindParam(':alg', $keyPair->alg); + $stmt->bindParam(':creation_time', $now); $stmt->execute();