refactor(jans-cedarling): streamline token deserialization in JwtService

[rmarinn]

Prepare

• Read PR guidelines
• Read license information

---

Description

This PR streamlines the token deserialization process in JwtService by eliminating redundant calls to jsonwebtoken::decode. Instead, it implements the From trait, providing callers with a straightforward method for converting to the required structs.

Target issue

target issue: #9967

closes #9967

Implementation Details

• Macro Implementation: The addition of the impl_jwt_for_token! macro streamlines the implementation of the JsonWebToken trait for various token types. This reduces boilerplate code and ensures consistency across token definitions.
• Unified Token Struct: A new Token struct has been introduced to encapsulate common claims (iss, aud, sub) across different token types. This abstraction facilitates easier management and retrieval of token claims.
• Claims Trait: The Claims trait has been defined to provide a uniform interface for accessing token claims. This promotes code reusability and improves maintainability by separating claims handling from the token data structures.
• Refactoring of Claim Setting: A trait-based approach for setting optional claims has been added, making parts of the code easaier to read since there's no more consecutive if-elses when setting the validation settings.
• Elimination of Redundant Deserialization: The refactor optimizes the deserialize_tokens function by removing unnecessary calls to jsonwebtoken::decode, thus improving efficiency and reducing overhead.

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The provided code changes focus on improving the handling and validation of JSON Web Tokens (JWTs) in the Cedarling application, introducing a robust JWT service with comprehensive token validation, flexible decoding strategies, secure key handling, and extensive test coverage, demonstrating a well-designed and secure approach to JWT handling.

Expand for full summary

Summary:

The provided code changes focus on improving the handling and validation of JSON Web Tokens (JWTs) in the Cedarling application. The changes introduce a robust JWT service with support for decoding and validating access tokens, ID tokens, and userinfo tokens. The key security-related aspects include:

1. Comprehensive Token Validation: The JwtService performs thorough validation of the token claims, including checks for the correct issuer, audience, and subject. This helps mitigate common security vulnerabilities, such as token replay attacks and impersonation attacks.

2. Flexible Decoding Strategies: The JwtService supports two decoding strategies: one with validation and one without. This allows the application to use the appropriate strategy based on the security requirements of the specific use case.

3. Secure Key Handling: The code includes the implementation of a KeyService that fetches the necessary public keys from the JWKS endpoint, ensuring that the correct keys are used for token verification.

4. Extensive Test Coverage: The provided test cases cover a wide range of scenarios, including handling of unsupported algorithms, audience validation, and JWKS updates. This helps ensure the security and reliability of the JWT handling functionality.

5. Separation of Concerns: The code separates the token handling logic from the authorization-specific data structures, promoting better maintainability and security by limiting the exposure of sensitive information.

Overall, the code changes demonstrate a well-designed and secure approach to JWT handling in the Cedarling application, with a focus on implementing best practices for authentication and authorization.

Files Changed:

1. jans-cedarling/cedarling/src/jwt/mod.rs: This file introduces the JwtService struct, which is responsible for decoding and validating JWTs based on a specified decoding strategy.

2. jans-cedarling/cedarling/src/authz/mod.rs: The changes in this file simplify the JWT token decoding process and improve the handling of the decoded token data.

3. jans-cedarling/cedarling/src/authz/token_data.rs: This file defines structures and utility functions for working with token payloads, including access tokens, ID tokens, and userinfo tokens.

4. jans-cedarling/cedarling/src/jwt/decoding_strategy.rs: The changes in this file introduce two decoding strategies: one with validation and one without, allowing for more flexible token handling.

5. Several test files, such as can_decode_claims_with_validation.rs, can_decode_claims_without_validation.rs, errors_on_invalid_aud.rs, can_update_local_jwks.rs, and errors_on_unsupported_alg.rs, which demonstrate the comprehensive testing of the JWT handling functionality.

6. jans-cedarling/cedarling/src/jwt/token.rs and jans-cedarling/cedarling/src/jwt/test/utils.rs, which introduce new structures and functions for handling and generating JWT claims and tokens.

Code Analysis

We ran 9 analyzers against 11 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.