ARC-1234: Keygenerator for Signing and Encryption Keys

.gitignore

@@ -6,3 +6,4 @@ gesundheitsid/dependency-reduced-pom.xml
 .flattened-pom.xml
 *_jwks.json
 env.properties
+*.pem

README.md

@@ -91,6 +91,25 @@ Setting up a proxy with a header filter can get around that limitation though.
     /~q & ~d gsi.dev.gematik.solutions/X-Authorization/<value goes here>
     ```
 
+## Setup Test VM
+
+```shell
+
+sudo apt update
+sudo apt install jq openjdk-17-jre-headless
+
+# install caddy
+sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
+sudo apt update
+sudo apt install caddy
+
+sudo systemctl disable --now caddy
+
+sudo caddy reverse-proxy --from=t.oviva.io --to=:1234
+```
+
 
 ## Helpful Links
 

esgen/pom.xml

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <groupId>com.oviva.gesundheitsid</groupId>
+    <artifactId>gesundheitsid-parent</artifactId>
+    <version>0.0.1-SNAPSHOT</version>
+  </parent>
+
+  <artifactId>esgen</artifactId>
+  <packaging>jar</packaging>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-api</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-classic</artifactId>
+    </dependency>
+
+    <dependency>
+      <groupId>com.nimbusds</groupId>
+      <artifactId>nimbus-jose-jwt</artifactId>
+    </dependency>
+
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-params</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.hamcrest</groupId>
+      <artifactId>hamcrest</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-junit-jupiter</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-core</artifactId>
+      <scope>test</scope>
+    </dependency>
+
+  </dependencies>
+
+</project>

esgen/src/main/java/com/oviva/gesundheitsid/esgen/Main.java

@@ -0,0 +1,94 @@
+package com.oviva.gesundheitsid.esgen;
+
+import com.nimbusds.jose.JOSEException;
+import com.nimbusds.jose.jwk.Curve;
+import com.nimbusds.jose.jwk.ECKey;
+import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.jose.jwk.KeyUse;
+import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.security.Key;
+import java.util.Base64;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class Main {
+
+  private static final Logger logger = LoggerFactory.getLogger(Main.class);
+
+  public static void main(String[] args) {
+
+    var main = new Main();
+    try {
+      main.run();
+    } catch (Exception e) {
+      logger.atError().setCause(e).log("key generator failed");
+      System.exit(1);
+    }
+  }
+
+  public void run() throws JOSEException, IOException { // your business logic goes here...
+
+    logger.atInfo().log("generating ES256 keys");
+
+    var federationSigningKey =
+        new ECKeyGenerator(Curve.P_256)
+            .keyUse(KeyUse.SIGNATURE)
+            .keyIDFromThumbprint(true)
+            .generate();
+
+    var sigName = "sig";
+    var encName = "enc";
+
+    saveJwks(sigName, new JWKSet(federationSigningKey));
+    savePublicEncoded(sigName, federationSigningKey);
+
+    var federationIdTokenEncryptionKey =
+        new ECKeyGenerator(Curve.P_256)
+            .keyUse(KeyUse.ENCRYPTION)
+            .keyIDFromThumbprint(true)
+            .generate();
+
+    saveJwks(encName, new JWKSet(federationIdTokenEncryptionKey));
+    savePublicEncoded(encName, federationIdTokenEncryptionKey);
+  }
+
+  private void saveJwks(String name, JWKSet set) throws IOException {
+    var jwks = set.toString(false);
+    writeString(Path.of("%s_jwks.json".formatted(name)), jwks);
+  }
+
+  private void savePublicEncoded(String name, ECKey jwk) throws JOSEException, IOException {
+
+    var publicEncodedPem = encodeAsPem(jwk.toPublicKey(), "PUBLIC KEY");
+    var p = Path.of("%s_pub.pem".formatted(name));
+    writeString(p, publicEncodedPem);
+  }
+
+  private String encodeAsPem(Key k, String type) {
+
+    var encoded = Base64.getEncoder().encodeToString(k.getEncoded());
+
+    var sb = new StringBuilder();
+    sb.append("-----BEGIN %s-----%n".formatted(type));
+
+    while (!encoded.isEmpty()) {
+      var end = Math.min(64, encoded.length());
+      var line = encoded.substring(0, end);
+      sb.append(line).append('\n');
+      encoded = encoded.substring(end);
+    }
+
+    sb.append("-----END %s-----%n".formatted(type));
+    return sb.toString();
+  }
+
+  private void writeString(Path p, String contents) throws IOException {
+
+    Files.writeString(p, contents, StandardOpenOption.TRUNCATE_EXISTING, StandardOpenOption.CREATE);
+    logger.atInfo().log("written '%s'".formatted(p));
+  }
+}

esgen/src/main/resources/logback.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+  <appender name="stdout" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{HH:mm:ss} %highlight(%-5level) %msg %kvp%n</pattern>
+    </encoder>
+  </appender>
+  <root level="INFO">
+    <appender-ref ref="stdout"/>
+  </root>
+</configuration>

gen_keys.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+mvn --quiet clean compile exec:java -Dexec.mainClass="com.oviva.gesundheitsid.esgen.Main" -f esgen

oidc-server/pom.xml

@@ -66,18 +66,9 @@
       <artifactId>logback-classic</artifactId>
     </dependency>
     <dependency>
-      <groupId>ch.qos.logback.contrib</groupId>
-      <artifactId>logback-json-classic</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>ch.qos.logback</groupId>
-          <artifactId>logback-core</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>ch.qos.logback.contrib</groupId>
-      <artifactId>logback-jackson</artifactId>
+      <groupId>net.logstash.logback</groupId>
+      <artifactId>logstash-logback-encoder</artifactId>
+      <version>7.4</version>
     </dependency>
     <!-- END logging-->
 
@@ -150,4 +141,35 @@
 
   </dependencies>
 
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-assembly-plugin</artifactId>
+
+        <configuration>
+          <archive>
+            <manifest>
+              <mainClass>com.oviva.gesundheitsid.relyingparty.Main</mainClass>
+            </manifest>
+          </archive>
+          <descriptorRefs>
+            <descriptorRef>jar-with-dependencies</descriptorRef>
+          </descriptorRefs>
+        </configuration>
+
+        <executions>
+          <execution>
+            <id>make-assembly</id>
+            <phase>package</phase>
+            <goals>
+              <goal>single</goal>
+            </goals>
+          </execution>
+        </executions>
+
+      </plugin>
+    </plugins>
+  </build>
+
 </project>