test(jans-cedarling): add tests and fix bugs caught in testing

[rmarinn]

Prepare

• Read PR guidelines
• Read license information

---

Description

This PR adds tests for JwtService to improve test coverage. Please see the target issue for the tests covered.

Target issue

target issue: #9995

closes #9995

Implementation Details

---

Test and Document the changes

• [x Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on improving the security and reliability of the JWT (JSON Web Token) handling functionality in the Cedarling application, with changes spanning several files and covering various aspects of JWT decoding, validation, and error handling.

Expand for full summary

Summary:

The code changes in this pull request focus on improving the security and reliability of the JWT (JSON Web Token) handling functionality in the Cedarling application. The changes span several files and cover various aspects of JWT decoding, validation, and error handling.

Key security-related improvements include:

1. Improved Error Handling: The code introduces a more comprehensive error handling mechanism, with detailed error types that cover various failure scenarios, such as unsupported algorithms, missing key IDs, and validation failures.
2. Enhanced Validation Logic: The JWT decoding and validation process has been strengthened, with more thorough checks for claims, such as ensuring the consistency of the iss (issuer), aud (audience), and sub (subject) claims across different token types.
3. Secure Key Management: The code demonstrates a well-designed approach to fetching and managing the keys used for JWT signature verification, including handling scenarios where the JWKS (JSON Web Key Set) or OpenID configuration endpoints are unreachable.
4. Comprehensive Testing: The test suite has been expanded to cover a wide range of negative scenarios, ensuring that the JWT service can properly handle invalid or malicious tokens and maintain the application's security.

Overall, the changes in this pull request show a strong focus on improving the security and robustness of the JWT handling functionality in the Cedarling application, which is a critical component for securing the application's authentication and authorization processes.

Files Changed:

1. authz/mod.rs: Updates the AuthorizeError enum to use the more generic jwt::Error instead of the specific jwt::JwtDecodingError.
2. jwt/decoding_strategy.rs: Introduces two decoding strategies, WithoutValidation and WithValidation, with the latter performing important validation checks on the JWT.
3. common/policy_store.rs: Includes changes related to the handling of trusted issuers and token metadata, which are important for ensuring the security of the authorization process.
4. authorize_with_jwt_validation.rs: Updates the sample JWT claims to include more detailed user information, which can enhance the security and usability of the application.
5. key_service/error.rs: Simplifies the error handling in the key service component, which is crucial for the security of the JWT validation process.
6. mod.rs: Improves the validation logic for the access_token, id_token, and userinfo_token, ensuring consistency and security across the different token types.
7. Various test files: Expand the test suite to cover a wide range of negative scenarios, ensuring the robustness and security of the JWT handling functionality.

Code Analysis

We ran 9 analyzers against 20 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.