fix: federation jwks for signing EC

Author: peppelinux

pyeudiw/satosa/frontends/openid4vci/endpoints/metadata_endpoint.py

@@ -36,7 +36,6 @@ def __init__(
             config.get("trust", {}).get("federation", {}).get("config", {})
         )
         super().__init__(config, internal_attributes, base_url, name)
-        self.metadata_jwks = config.get("metadata_jwks", [])
         self.federation_jwks = self.federation_config.get("federation_jwks", [])
 
     def _ensure_credential_issuer(
@@ -106,15 +105,15 @@ def entity_configuration(self) -> str:
         """
 
         data = self.entity_configuration_as_dict
-        _jwk = self.metadata_jwks[0]
-        jwshelper = JWSHelper(self.federation_jwks)
+        _jwk = self.federation_jwks[0]
+        jwshelper = JWSHelper(_jwk)
         return jwshelper.sign(
             protected={
                 "alg": self.federation_config.get("default_sig_alg"),
+                "kid": _jwk["kid"],
                 "typ": "entity-statement+jwt",
             },
             plain_dict=data,
-            kid_in_header=True
         )
 
     def endpoint(self, context: Context) -> Response:

pyeudiw/tests/satosa/frontends/openid4vci/endpoints/test_metadata_endpoint.py

@@ -4,6 +4,9 @@
 import pytest
 from satosa.context import Context
 
+from pyeudiw.jwk import JWK
+from pyeudiw.jwt.exceptions import JWSVerificationError
+from pyeudiw.jwt.jws_helper import JWSHelper
 from pyeudiw.jwt.utils import base64_urldecode
 from pyeudiw.satosa.frontends.openid4vci.endpoints.metadata_endpoint import (
     MetadataHandler,
@@ -16,6 +19,7 @@
     MOCK_CREDENTIAL_CONFIGURATIONS,
     MOCK_CREDENTIAL_STORAGE_CONFIG,
     MOCK_ENDPOINTS_CONFIG,
+    MOCK_FEDERATION_JWKS_CONFIG,
     MOCK_INTERNAL_ATTRIBUTES,
     MOCK_JWT_CONFIG,
     MOCK_METADATA_JWKS_CONFIG,
@@ -172,9 +176,20 @@ def test_endpoint_returns_jwt(metadata_handler, context):
     jwt_parts = response.message.split(".")
     header = json.loads(base64_urldecode(jwt_parts[0]))
     assert header["alg"] == "ES256"
-    assert header["kid"] == MOCK_PYEUDIW_FRONTEND_CONFIG["metadata_jwks"][0]["kid"]
+    assert header["kid"] == MOCK_FEDERATION_JWKS_CONFIG[0]["kid"]
     assert header["typ"] == "entity-statement+jwt"
 
+    federation_public_keys = [
+        JWK(k).as_public_dict() for k in MOCK_FEDERATION_JWKS_CONFIG
+    ]
+    JWSHelper(federation_public_keys).verify(response.message)
+
+    metadata_public_keys = [
+        JWK(k).as_public_dict() for k in MOCK_METADATA_JWKS_CONFIG
+    ]
+    with pytest.raises(JWSVerificationError):
+        JWSHelper(metadata_public_keys).verify(response.message)
+
     payload = json.loads(base64_urldecode(jwt_parts[1]))
     _assert_metadata(
         MOCK_PYEUDIW_FRONTEND_CONFIG,

pyeudiw/tests/satosa/frontends/openid4vci/mock_openid4vci.py

@@ -30,12 +30,25 @@
     }
 ]
 
+MOCK_FEDERATION_JWKS_CONFIG = [
+    {
+        "kty": "EC",
+        "d": "bp6MRMWoigS7NWYSgttPh3vG-smWbn10nUt3mozW4z0",
+        "use": "sig",
+        "crv": "P-256",
+        "kid": "DTPMAB4HYvbzjqHDA_7JA558_N7SARKtfwlba1gDUgc",
+        "x": "fqN7TJfZdx2idFkWKw3jxCshRDNpWpQ-Sntj-Vj6fiA",
+        "y": "tpS6deZDQFKOmYS8BAZgpcaEzy72kZBdE7OabBnKQo4",
+        "alg": "ES256",
+    }
+]
+
 MOCK_TRUST_CONFIG = {
     "federation": {
         "config": {
             "entity_configuration_exp": 600,
             "default_sig_alg": "ES256",
-            "federation_jwks": MOCK_METADATA_JWKS_CONFIG,
+            "federation_jwks": MOCK_FEDERATION_JWKS_CONFIG,
             "authority_hints": [],
         }
     }