mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
9067605b66
* fix(crypto): use authenticated encryption for IDP intent tokens IDP intent tokens were encrypted with AES-CFB which provides no integrity protection, making them malleable. Switch to A256GCM via the existing AuthAlgorithm interface (EncryptToken/DecryptToken), the same approach already used for OIDC and session tokens. The idpConfigEncryption key type is widened from EncryptionAlgorithm to AuthEncryptionAlgorithm so that data-at-rest encryption (IDP client secrets, LDAP bind passwords, SAML keys) continues to use the CFB path unmodified. Co-authored-by: Cursor <[email protected]> * fix(proto): raise IDP intent token max length to 500 for authenticated tokens The switch to authenticated A256GCM (JWE compact serialization) makes IDP intent tokens longer (~270 chars) than the previous AES-CFB base64 output. Raise the max_len/max_length validation and OpenAPI constraints on every idp_intent_token field from 200 to 500 so the new tokens are accepted: user v2/v2beta (idp + user_service), session v2/v2beta, and resources user v3alpha. Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Cursor <[email protected]> Co-authored-by: Claude Opus 4.8 <[email protected]>
63 lines
1.7 KiB
Go
63 lines
1.7 KiB
Go
package domain
|
|
|
|
import (
|
|
"github.com/zitadel/zitadel/backend/v3/storage/database"
|
|
"github.com/zitadel/zitadel/backend/v3/storage/eventstore"
|
|
"github.com/zitadel/zitadel/internal/config/systemdefaults"
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
"github.com/zitadel/zitadel/internal/webauthn"
|
|
)
|
|
|
|
var (
|
|
pool database.Pool
|
|
legacyEventstore eventstore.LegacyEventstore
|
|
sysConfig systemdefaults.SystemDefaults
|
|
passwordHasher *crypto.Hasher
|
|
idpEncryptionAlgo crypto.AuthEncryptionAlgorithm
|
|
sessionTokenDecryptor SessionTokenDecryptor
|
|
mfaEncryptionAlgo crypto.EncryptionAlgorithm
|
|
otpSMSSecretGeneratorConfig *crypto.GeneratorConfig
|
|
otpEmailSecretGeneratorConfig *crypto.GeneratorConfig
|
|
webauthnConfig *webauthn.Config
|
|
)
|
|
|
|
func SetPool(p database.Pool) {
|
|
pool = p
|
|
}
|
|
|
|
func SetLegacyEventstore(es eventstore.LegacyEventstore) {
|
|
legacyEventstore = es
|
|
}
|
|
|
|
func SetSystemConfig(cfg systemdefaults.SystemDefaults) {
|
|
sysConfig = cfg
|
|
}
|
|
|
|
func SetPasswordHasher(hasher *crypto.Hasher) {
|
|
passwordHasher = hasher
|
|
}
|
|
|
|
func SetIDPEncryptionAlgorithm(idpEncryptionAlg crypto.AuthEncryptionAlgorithm) {
|
|
idpEncryptionAlgo = idpEncryptionAlg
|
|
}
|
|
|
|
func SetSessionTokenDecryptor(decryptor SessionTokenDecryptor) {
|
|
sessionTokenDecryptor = decryptor
|
|
}
|
|
|
|
func SetOTPSMSSecretGeneratorConfig(cfg *crypto.GeneratorConfig) {
|
|
otpSMSSecretGeneratorConfig = cfg
|
|
}
|
|
|
|
func SetWebAuthNConfig(cfg *webauthn.Config) {
|
|
webauthnConfig = cfg
|
|
}
|
|
|
|
func SetOTPEmailSecretGeneratorConfig(cfg *crypto.GeneratorConfig) {
|
|
otpEmailSecretGeneratorConfig = cfg
|
|
}
|
|
|
|
func SetMFAEncryptionAlgorithm(mfaEncryptionAlg crypto.EncryptionAlgorithm) {
|
|
mfaEncryptionAlgo = mfaEncryptionAlg
|
|
}
|