python-oauthlib/jwcrypto.patch

commit 388ddb783c7bff39feea87dd7e2ac0bfd410d82a
Author: John Dennis <jdennis@redhat.com>
Date:   Thu Mar 16 10:18:57 2017 -0400

    Use jwcrypto instead of jwt
    
    * Replace all imports of jwt with jwcrypto, continue to rely on cryptography
    * Update doc replacing jwt with jwcrypto
    * Update dependencies and requirements
    * Add utility functions get_rsa_public_key() and get_rsa_private_key()
      to obtain cryptography's RSAPublicKey and RSAPrivateKey
    * Add utility normalize_claims() replicate type conversion jwt offered,
      primarially datatime conversion
    * Refactor to use common code and separate concerns
    * Replace jwt's RSA-SHA1 signature with primitives from cryptography
    
    Signed-off-by: John Dennis <jdennis@redhat.com>

diff --git a/oauthlib/common.py b/oauthlib/common.py
index 5d999b2..5fc0a3c 100644
--- a/oauthlib/common.py
+++ b/oauthlib/common.py
@@ -15,6 +15,16 @@ import random
 import re
 import sys
 import time
+from calendar import timegm
+
+from jwcrypto.jwk import JWK
+from jwcrypto.jwt import JWT
+from jwcrypto.common import json_decode
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives.serialization import (
+    load_pem_private_key, load_pem_public_key)
+from cryptography.hazmat.primitives.asymmetric.rsa import (
+    RSAPrivateKey, RSAPublicKey)
 
 try:
     from urllib import quote as _quote
@@ -229,28 +239,69 @@ def generate_token(length=30, chars=UNICODE_ASCII_CHARACTER_SET):
     return ''.join(rand.choice(chars) for x in range(length))
 
 
-def generate_signed_token(private_pem, request):
-    import jwt
+def get_rsa_private_key(data):
+    if isinstance(data, (bytes_type, unicode_type)):
+        if isinstance(data, unicode_type):
+            data = data.encode('ascii')
+        # load_pem_private_key() requires the data to be str or bytes
+        private_key = load_pem_private_key(data, None, default_backend())
+    else:
+        private_key = data
+
+    if not isinstance(private_key, RSAPrivateKey):
+        raise TypeError("Expected RSAPrivateKey, but got %s" %
+                        private_key.__class__.__name__)
+
+    return private_key
+
+
+def get_rsa_public_key(data):
+    if isinstance(data, (bytes_type, unicode_type)):
+        if isinstance(data, unicode_type):
+            data = data.encode('ascii')
+        # load_pem_public_key() requires the data to be str or bytes
+        public_key = load_pem_public_key(data, default_backend())
+    else:
+        public_key = data
+
+    if not isinstance(public_key, RSAPublicKey):
+        raise TypeError("Expected RSAPublicKey, but got %s" %
+                        public_key.__class__.__name__)
+
+    return public_key
 
-    now = datetime.datetime.utcnow()
 
+def normalize_claims(claims):
+    for claim in ['exp', 'iat', 'nbf']:
+        # Convert datetime to a intDate value in known time-format claims
+        if isinstance(claims.get(claim), datetime.datetime):
+            claims[claim] = timegm(claims[claim].utctimetuple())
+    return claims
+
+
+def generate_jwt_assertion(private_key, claims):
+    rsa_private_key = get_rsa_private_key(private_key)
+    jwkey = JWK.from_pyca(rsa_private_key)
+    token = JWT(header={'alg': 'RS256'}, claims=normalize_claims(claims))
+    token.make_signed_token(jwkey)
+    return to_unicode(token.serialize(), "UTF-8")
+
+
+def generate_signed_token(private_pem, request):
+    now = datetime.datetime.utcnow()
     claims = {
         'scope': request.scope,
         'exp': now + datetime.timedelta(seconds=request.expires_in)
     }
-
     claims.update(request.claims)
+    return generate_jwt_assertion(private_pem, claims)
 
-    token = jwt.encode(claims, private_pem, 'RS256')
-    token = to_unicode(token, "UTF-8")
-
-    return token
-
-
-def verify_signed_token(public_pem, token):
-    import jwt
 
-    return jwt.decode(token, public_pem, algorithms=['RS256'])
+def verify_signed_token(public_key, token):
+    rsa_public_key = get_rsa_public_key(public_key)
+    jwkey = JWK.from_pyca(rsa_public_key)
+    signed_token = JWT(key=jwkey, jwt=token)
+    return json_decode(signed_token.claims)
 
 
 def generate_client_id(length=30, chars=CLIENT_ID_CHARACTER_SET):
diff --git a/oauthlib/oauth1/rfc5849/signature.py b/oauthlib/oauth1/rfc5849/signature.py
index 8fa22ba..6956732 100644
--- a/oauthlib/oauth1/rfc5849/signature.py
+++ b/oauthlib/oauth1/rfc5849/signature.py
@@ -31,8 +31,15 @@ try:
 except ImportError:
     import urllib.parse as urlparse
 from . import utils
-from oauthlib.common import urldecode, extract_params, safe_string_equals
-from oauthlib.common import bytes_type, unicode_type
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import padding
+from jwcrypto.jwk import JWK
+from jwcrypto.jws import JWS
+
+from oauthlib.common import (urldecode, extract_params, safe_string_equals,
+                             bytes_type, unicode_type,
+                             get_rsa_private_key, get_rsa_public_key)
 
 
 def construct_base_string(http_method, base_string_uri,
@@ -464,17 +471,8 @@ def sign_hmac_sha1(base_string, client_secret, resource_owner_secret):
     # .. _`RFC2045, Section 6.8`: http://tools.ietf.org/html/rfc2045#section-6.8
     return binascii.b2a_base64(signature.digest())[:-1].decode('utf-8')
 
-_jwtrs1 = None
-
-#jwt has some nice pycrypto/cryptography abstractions
-def _jwt_rs1_signing_algorithm():
-    global _jwtrs1
-    if _jwtrs1 is None:
-        import jwt.algorithms as jwtalgo
-        _jwtrs1 = jwtalgo.RSAAlgorithm(jwtalgo.hashes.SHA1)
-    return _jwtrs1
 
-def sign_rsa_sha1(base_string, rsa_private_key):
+def sign_rsa_sha1(base_string, private_key):
     """**RSA-SHA1**
 
     Per `section 3.4.3`_ of the spec.
@@ -493,10 +491,11 @@ def sign_rsa_sha1(base_string, rsa_private_key):
     if isinstance(base_string, unicode_type):
         base_string = base_string.encode('utf-8')
     # TODO: finish RSA documentation
-    alg = _jwt_rs1_signing_algorithm()
-    key = _prepare_key_plus(alg, rsa_private_key)
-    s=alg.sign(base_string, key)
-    return binascii.b2a_base64(s)[:-1].decode('utf-8')
+    key = get_rsa_private_key(private_key)
+    signer = key.signer(padding.PKCS1v15(), hashes.SHA1())
+    signer.update(base_string)
+    signature = signer.finalize()
+    return binascii.b2a_base64(signature)[:-1].decode('utf-8')
 
 
 def sign_rsa_sha1_with_client(base_string, client):
@@ -568,17 +567,13 @@ def verify_hmac_sha1(request, client_secret=None,
                                resource_owner_secret)
     return safe_string_equals(signature, request.signature)
 
-def _prepare_key_plus(alg, keystr):
-    if isinstance(keystr, bytes_type):
-        keystr = keystr.decode('utf-8')
-    return alg.prepare_key(keystr)
 
 def verify_rsa_sha1(request, rsa_public_key):
     """Verify a RSASSA-PKCS #1 v1.5 base64 encoded signature.
 
     Per `section 3.4.3`_ of the spec.
 
-    Note this method requires the jwt and cryptography libraries.
+    Note this method requires the cryptography library.
 
     .. _`section 3.4.3`: http://tools.ietf.org/html/rfc5849#section-3.4.3
 
@@ -595,9 +590,14 @@ def verify_rsa_sha1(request, rsa_public_key):
     message = construct_base_string(request.http_method, uri, norm_params).encode('utf-8')
     sig = binascii.a2b_base64(request.signature.encode('utf-8'))
 
-    alg = _jwt_rs1_signing_algorithm()
-    key = _prepare_key_plus(alg, rsa_public_key)
-    return alg.verify(message, key, sig)
+    key = get_rsa_public_key(rsa_public_key)
+    verifier = key.verifier(sig, padding.PKCS1v15(), hashes.SHA1())
+    verifier.update(message)
+    try:
+        verifier.verify()
+        return True
+    except InvalidSignature:
+        return False
 
 
 def verify_plaintext(request, client_secret=None, resource_owner_secret=None):
diff --git a/oauthlib/oauth2/rfc6749/clients/service_application.py b/oauthlib/oauth2/rfc6749/clients/service_application.py
index 36da98b..d974b1d 100644
--- a/oauthlib/oauth2/rfc6749/clients/service_application.py
+++ b/oauthlib/oauth2/rfc6749/clients/service_application.py
@@ -10,7 +10,7 @@ from __future__ import absolute_import, unicode_literals
 
 import time
 
-from oauthlib.common import to_unicode
+from oauthlib.common import generate_jwt_assertion
 
 from .base import Client
 from ..parameters import prepare_token_request
@@ -139,7 +139,6 @@ class ServiceApplicationClient(Client):
 
         .. _`Section 3.2.1`: http://tools.ietf.org/html/rfc6749#section-3.2.1
         """
-        import jwt
 
         key = private_key or self.private_key
         if not key:
@@ -166,8 +165,7 @@ class ServiceApplicationClient(Client):
 
         claim.update(extra_claims or {})
 
-        assertion = jwt.encode(claim, key, 'RS256')
-        assertion = to_unicode(assertion)
+        assertion = generate_jwt_assertion(key, claim)
 
         return prepare_token_request(self.grant_type,
                                      body=body,
diff --git a/setup.py b/setup.py
index 718db43..77cd6c8 100755
--- a/setup.py
+++ b/setup.py
@@ -18,11 +18,11 @@ def fread(fn):
         return f.read()
 
 if sys.version_info[0] == 3:
-    tests_require = ['nose', 'cryptography', 'pyjwt>=1.0.0', 'blinker']
+    tests_require = ['nose', 'cryptography', 'jwcrypto>=0.3.2', 'blinker']
 else:
-    tests_require = ['nose', 'unittest2', 'cryptography', 'mock', 'pyjwt>=1.0.0', 'blinker']
+    tests_require = ['nose', 'unittest2', 'cryptography', 'mock', 'jwcrypto>=0.3.2', 'blinker']
 rsa_require = ['cryptography']
-signedtoken_require = ['cryptography', 'pyjwt>=1.0.0']
+signedtoken_require = ['cryptography', 'jwcrypto>=0.3.2']
 signals_require = ['blinker']
 
 requires = []
diff --git a/tests/oauth2/rfc6749/clients/test_service_application.py b/tests/oauth2/rfc6749/clients/test_service_application.py
index de57291..842bbcb 100644
--- a/tests/oauth2/rfc6749/clients/test_service_application.py
+++ b/tests/oauth2/rfc6749/clients/test_service_application.py
@@ -4,10 +4,9 @@ from __future__ import absolute_import, unicode_literals
 import os
 from time import time
 
-import jwt
 from mock import patch
 
-from oauthlib.common import Request
+from oauthlib.common import Request, verify_signed_token
 from oauthlib.oauth2 import ServiceApplicationClient
 
 from ....unittest import TestCase
@@ -92,10 +91,10 @@ mfvGGg3xNjTMO7IdrwIDAQAB
         self.assertEqual(r.isnot, 'empty') 
         self.assertEqual(r.grant_type, ServiceApplicationClient.grant_type) 
 
-        claim = jwt.decode(r.assertion, self.public_key, audience=self.audience, algorithms=['RS256'])
+        claim = verify_signed_token(self.public_key, r.assertion)
 
         self.assertEqual(claim['iss'], self.issuer)
-        # audience verification is handled during decode now
+        self.assertEqual(claim['aud'], self.audience)
         self.assertEqual(claim['sub'], self.subject)
         self.assertEqual(claim['iat'], int(t.return_value))
 
diff --git a/tests/oauth2/rfc6749/test_server.py b/tests/oauth2/rfc6749/test_server.py
index aff0d84..850d73e 100644
--- a/tests/oauth2/rfc6749/test_server.py
+++ b/tests/oauth2/rfc6749/test_server.py
@@ -2,7 +2,6 @@
 from __future__ import absolute_import, unicode_literals
 from ...unittest import TestCase
 import json
-import jwt
 import mock
 
 from oauthlib import common