Generate ES256 verifier key ready for HAIP rules#51200
Conversation
There was a problem hiding this comment.
Pull request overview
Updates OID4VP tests to use an ES256 signing key with a CA-issued certificate, satisfying HAIP requirements.
Changes:
- Generates P-256 CA and leaf key pairs.
- Configures the verifier key provider with the non-self-signed leaf certificate and keys.
Closes keycloak#51191 Signed-off-by: rmartinc <rmartinc@redhat.com>
|
Added some constants instead direct strings. Nothing important changed. |
mabartos
left a comment
There was a problem hiding this comment.
LGTM, just one comment for a follow-up.
| GeneratedEcdsaKeyProviderFactory.ECDSA_PUBLIC_KEY_KEY, List.of( | ||
| Base64.getEncoder().encodeToString(leafKeyPair.getPublic().getEncoded())), | ||
| GeneratedEcdsaKeyProviderFactory.ECDSA_ELLIPTIC_CURVE_KEY, List.of("P-256"), | ||
| Attributes.EC_GENERATE_CERTIFICATE_KEY, List.of("true")))); |
There was a problem hiding this comment.
So, the EC_GENERATE_CERTIFICATE_KEY is not sufficient here, right? Is it worth extending it to comply with the HAIP compliance?
EDIT: Not a blocker, just for the follow-up consideration.
There was a problem hiding this comment.
Yep, not sufficient for HAIP. The generate certificate attribute creates a self-signed one, this is what it was done before but after #51176 we need to have a CA+leaf configuration in the key.
In real configurations (for example conformance tests), the provider used is not the common generated EC (which is intended for self-signed always). Normally a Java Keystore is used where you do a normal request, obtain a cert signed by a CA and so on and so forth. But for tests I'm just doing this trick which is the same we are using for vci.
I think that it's enough for testing.
Closes #51191
The verifier key for the oid4vp tests follow HAIP rules enforced by #51176. Similar to what oid4vci is doing.