microsoft-authentication-library-for-java
microsoft-authentication-library-for-java copied to clipboard
Use recommended algorithm in assertions
Fixes the issue described in https://github.com/AzureAD/microsoft-authentication-library-for-java/issues/958
Microsoft recommends PS256 for assertions and other MSALs follow this, however MSAL Java still used RS256. It seems like PSS support was only added in Java 11, but it was thankfully backported to Java 8.
This PR refactors JwtHelper to use the recommended algorithm and adjusts/expands tests in order to cover the new behavior.
In addition, while making the changes I discovered a weird edge case:
- To create a Signature instance to sign the assertion, we need to provide a
PrivateKey - When retrieving a
PrivateKeyfrom the Windows-MY keystore the underlying type is "sun.security.mscapi.CPrivateKey" - The
sun.security.mscapi.CPrivateKeytype was accepted by the Signature instance created with "SHA256withRSA", but for some reason the Signature created with "RSASSA-PSS" throws an error about it not specifically being anRSAPrivateKeyinstance
Since our integration tests use a cert stored in Windows-MY simply changing the assertion to use PS256 would've broken many of our tests. I'm sure plenty of our customers retrieve certs in the same way, and I'm not sure what other key types would cause this error.
So to avoid any breaking changes, this PR also implements a mechanism to fallback to the old RS256 style when we get a certain exception, and has extra tests covering this fallback behavior.