feat(bosh-nats-sync): verify UAA JWT RS256 signature when uaa_public_key is set

Author: aramprice

src/bosh-nats-sync/pkg/authprovider/auth_provider.go

@@ -2,8 +2,13 @@ package authprovider
 
 import (
 	"context"
+	"crypto"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
+	"encoding/pem"
 	"fmt"
 	"log/slog"
 	"net/http"
@@ -92,6 +97,16 @@ func (a *AuthProvider) uaaTokenHeader(ctx context.Context, uaaURL string) (strin
 	if err != nil {
 		return "", fmt.Errorf("failed to obtain token from UAA: %w", err)
 	}
+
+	// Mirror Ruby UAAToken decode_options: when uaa_public_key is configured,
+	// verify the JWT RS256 signature. This guards against a compromised token
+	// even when the TLS channel is intact.
+	if pubKey := strings.TrimSpace(a.config.UAAPublicKey); pubKey != "" {
+		if err := verifyJWTRS256(tok.AccessToken, pubKey); err != nil {
+			return "", fmt.Errorf("UAA JWT signature verification failed: %w", err)
+		}
+	}
+
 	a.token = tok
 	return formatBearer(tok), nil
 }
@@ -140,6 +155,61 @@ func (a *AuthProvider) CAFilePath() string {
 	return a.config.DirectorCACert
 }
 
+// verifyJWTRS256 verifies that the JWT was signed with the RSA private key
+// corresponding to pemPublicKey. It mirrors the Ruby UAAToken decode_options
+// path where { pkey: @uaa_public_key, verify: true } is passed to
+// CF::UAA::TokenCoder.decode when a public key is configured.
+//
+// Only RS256 (RSASSA-PKCS1-v1.5 with SHA-256) is accepted because that is
+// the algorithm UAA uses for its signing keys.
+func verifyJWTRS256(jwtToken, pemPublicKey string) error {
+	parts := strings.SplitN(jwtToken, ".", 3)
+	if len(parts) != 3 {
+		return fmt.Errorf("invalid JWT: expected 3 parts, got %d", len(parts))
+	}
+
+	// Decode the header to confirm alg=RS256.
+	headerBytes, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return fmt.Errorf("invalid JWT header encoding: %w", err)
+	}
+	var header struct {
+		Alg string `json:"alg"`
+	}
+	if err := json.Unmarshal(headerBytes, &header); err != nil {
+		return fmt.Errorf("invalid JWT header JSON: %w", err)
+	}
+	if header.Alg != "RS256" {
+		return fmt.Errorf("unsupported JWT algorithm %q: only RS256 is supported", header.Alg)
+	}
+
+	// Decode the signature.
+	sig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return fmt.Errorf("invalid JWT signature encoding: %w", err)
+	}
+
+	// Hash the signing input (header + "." + payload).
+	signingInput := parts[0] + "." + parts[1]
+	digest := sha256.Sum256([]byte(signingInput))
+
+	// Parse the RSA public key from PEM.
+	block, _ := pem.Decode([]byte(pemPublicKey))
+	if block == nil {
+		return fmt.Errorf("failed to decode PEM block from uaa_public_key")
+	}
+	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
+	if err != nil {
+		return fmt.Errorf("failed to parse RSA public key: %w", err)
+	}
+	rsaPub, ok := pub.(*rsa.PublicKey)
+	if !ok {
+		return fmt.Errorf("uaa_public_key is not an RSA public key")
+	}
+
+	return rsa.VerifyPKCS1v15(rsaPub, crypto.SHA256, digest[:], sig)
+}
+
 func formatBearer(tok *oauth2.Token) string {
 	return "Bearer " + tok.AccessToken
 }

src/bosh-nats-sync/pkg/authprovider/auth_provider_test.go

@@ -2,9 +2,12 @@ package authprovider_test
 
 import (
 	"context"
+	"crypto"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/base64"
@@ -25,6 +28,37 @@ import (
 	"bosh-nats-sync/pkg/config"
 )
 
+// generateRSAKeyPair creates a 2048-bit RSA key pair for JWT signing tests.
+func generateRSAKeyPair() (*rsa.PrivateKey, []byte) {
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+	pubBytes, err := x509.MarshalPKIXPublicKey(&priv.PublicKey)
+	if err != nil {
+		panic(err)
+	}
+	pubPEM := pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pubBytes})
+	return priv, pubPEM
+}
+
+// createRS256JWT builds a minimal RS256-signed JWT for use in tests.
+func createRS256JWT(privKey *rsa.PrivateKey, expiresAt time.Time) string {
+	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"RS256","typ":"JWT"}`))
+	claimsJSON, _ := json.Marshal(map[string]interface{}{
+		"sub": "test-client",
+		"exp": expiresAt.Unix(),
+	})
+	payload := base64.RawURLEncoding.EncodeToString(claimsJSON)
+	sigInput := header + "." + payload
+	digest := sha256.Sum256([]byte(sigInput))
+	sig, err := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256, digest[:])
+	if err != nil {
+		panic(err)
+	}
+	return sigInput + "." + base64.RawURLEncoding.EncodeToString(sig)
+}
+
 // generateTestCACertPEM creates a minimal self-signed CA certificate PEM for use in tests.
 func generateTestCACertPEM() []byte {
 	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
@@ -443,6 +477,101 @@ var _ = Describe("AuthProvider", func() {
 		})
 	})
 
+	Context("when uaa_public_key is configured (JWT RS256 verification)", func() {
+		// Mirrors Ruby UAAToken decode_options: when uaa_public_key is non-empty,
+		// the fetched token's RS256 signature is verified against the public key.
+		var (
+			rsaPrivKey *rsa.PrivateKey
+			pubKeyPEM  []byte
+		)
+
+		BeforeEach(func() {
+			rsaPrivKey, pubKeyPEM = generateRSAKeyPair()
+		})
+
+		It("accepts a token whose RS256 signature matches uaa_public_key", func() {
+			validJWT := createRS256JWT(rsaPrivKey, time.Now().Add(time.Hour))
+			uaaServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				fmt.Fprintf(w, `{"access_token":%q,"token_type":"bearer","expires_in":3600}`, validJWT)
+			}))
+			defer uaaServer.Close()
+
+			info := authprovider.InfoResponse{
+				UserAuthentication: &authprovider.UserAuthentication{
+					Type:    "uaa",
+					Options: authprovider.UAAOptions{URL: uaaServer.URL},
+				},
+			}
+			cfg := config.DirectorConfig{
+				ClientID:     "fake-client",
+				ClientSecret: "fake-secret",
+				UAAPublicKey: string(pubKeyPEM),
+			}
+			provider := authprovider.New(info, cfg, logger)
+
+			header, err := provider.AuthHeader(context.Background())
+			Expect(err).NotTo(HaveOccurred())
+			Expect(header).To(Equal("Bearer " + validJWT))
+		})
+
+		It("rejects a token signed with a different RSA key", func() {
+			otherKey, _ := generateRSAKeyPair()
+			wrongJWT := createRS256JWT(otherKey, time.Now().Add(time.Hour))
+
+			uaaServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				fmt.Fprintf(w, `{"access_token":%q,"token_type":"bearer","expires_in":3600}`, wrongJWT)
+			}))
+			defer uaaServer.Close()
+
+			info := authprovider.InfoResponse{
+				UserAuthentication: &authprovider.UserAuthentication{
+					Type:    "uaa",
+					Options: authprovider.UAAOptions{URL: uaaServer.URL},
+				},
+			}
+			cfg := config.DirectorConfig{
+				ClientID:     "fake-client",
+				ClientSecret: "fake-secret",
+				UAAPublicKey: string(pubKeyPEM),
+			}
+			provider := authprovider.New(info, cfg, logger)
+
+			_, err := provider.AuthHeader(context.Background())
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("UAA JWT signature verification failed"))
+		})
+
+		It("skips JWT verification when uaa_public_key is empty (matching Ruby verify:false path)", func() {
+			// With an empty uaa_public_key the token is used as-is regardless of
+			// whether it is a valid JWT, matching Ruby's { verify: false } behaviour.
+			uaaServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				// Return a plain opaque string, not a JWT — verification must be skipped.
+				fmt.Fprint(w, `{"access_token":"opaque-token","token_type":"bearer","expires_in":3600}`)
+			}))
+			defer uaaServer.Close()
+
+			info := authprovider.InfoResponse{
+				UserAuthentication: &authprovider.UserAuthentication{
+					Type:    "uaa",
+					Options: authprovider.UAAOptions{URL: uaaServer.URL},
+				},
+			}
+			cfg := config.DirectorConfig{
+				ClientID:     "fake-client",
+				ClientSecret: "fake-secret",
+				UAAPublicKey: "",
+			}
+			provider := authprovider.New(info, cfg, logger)
+
+			header, err := provider.AuthHeader(context.Background())
+			Expect(err).NotTo(HaveOccurred())
+			Expect(header).To(Equal("Bearer opaque-token"))
+		})
+	})
+
 	Context("when director is in non-UAA mode", func() {
 		It("returns Basic authentication string with username and password", func() {
 			info := authprovider.InfoResponse{}

src/bosh-nats-sync/pkg/config/config.go

@@ -9,13 +9,20 @@ import (
 )
 
 type DirectorConfig struct {
-	URL                   string `yaml:"url"`
-	User                  string `yaml:"user"`
-	Password              string `yaml:"password"`
-	ClientID              string `yaml:"client_id"`
-	ClientSecret          string `yaml:"client_secret"`
-	DirectorCACert        string `yaml:"director_ca_cert"`
-	UAACACert             string `yaml:"uaa_ca_cert"`
+	URL            string `yaml:"url"`
+	User           string `yaml:"user"`
+	Password       string `yaml:"password"`
+	ClientID       string `yaml:"client_id"`
+	ClientSecret   string `yaml:"client_secret"`
+	DirectorCACert string `yaml:"director_ca_cert"`
+	UAACACert      string `yaml:"uaa_ca_cert"`
+	// UAAPublicKey is the PEM-encoded RSA public key used to verify UAA JWT
+	// signatures. When non-empty the token's RS256 signature is verified after
+	// each fetch, mirroring the Ruby UAAToken decode_options behaviour:
+	// { pkey: @uaa_public_key, verify: true }.
+	// When empty, signature verification is skipped (the TLS channel already
+	// authenticates the token source), matching Ruby's { verify: false } path.
+	UAAPublicKey          string `yaml:"uaa_public_key"`
 	DirectorSubjectFile   string `yaml:"director_subject_file"`
 	HMSubjectFile         string `yaml:"hm_subject_file"`
 	ConnectionWaitTimeout int    `yaml:"connection_wait_timeout"`

src/bosh-nats-sync/testdata/sample_config.yml

@@ -8,6 +8,7 @@ director:
   client_secret: client_secret
   director_ca_cert: director_ca_cert
   uaa_ca_cert: uaa_ca_cert
+  uaa_public_key: ''
   director_subject_file: /var/vcap/data/nats/director-subject
   hm_subject_file: /var/vcap/data/nats/hm-subject