From d41d27e0a72997c9b9a7e8ead86bfbb500806d40 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Sep 10 2016 12:39:43 +0000 Subject: Add compatibility with jwcrypto 0.3.0 and higher Jwcrypto 0.3.0 has moved the actual set with keys into a dict field 'keys' rather than being the set itself. We can't use the export function because that exports the private keys by default, and there's no way in 0.2.0 to indicate we don't want private keys, and we can't determine whether the function will accept this argument. Signed-off-by: Patrick Uiterwijk Reviewed-by: Howard Johnson --- diff --git a/ipsilon/providers/openidc/auth.py b/ipsilon/providers/openidc/auth.py index c48d9ef..3ea0865 100644 --- a/ipsilon/providers/openidc/auth.py +++ b/ipsilon/providers/openidc/auth.py @@ -743,9 +743,18 @@ class OpenIDC(ProviderPageBase): 'Content-Type': 'application/json' }) - # Sent to jwcrypto as https://github.com/latchset/jwcrypto/pull/20 + # In jwcrypto 0.3.0, JWKSet was changed to be a dict with all the keys + # in a keys field. Before that, it was a set and we need to loop over + # the object itself. + # We can't use the keyset.export function because in 0.2.0 it did not + # accept an argument to exclude private keys from the export, and there + # is no way to detect whether we're dealing with 0.3.0 or 0.2.0. + keyset = self.cfg.keyset + if isinstance(keyset, dict): + keyset = keyset['keys'] + keys = [] - for key in self.cfg.keyset: + for key in keyset: keys.append(json.loads(key.export_public())) return json.dumps({'keys': keys}) Jwks.public_function = True