[jira] [Commented] (SYNCOPE-1545) Web Access

[ASF subversion and git services (Jira)]

[ 
https://issues.apache.org/jira/browse/SYNCOPE-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17572003#comment-17572003
 ] 

ASF subversion and git services commented on SYNCOPE-1545:
--

Commit 828e72a056e849882b090352c77b6c1797d76a60 in syncope's branch 
refs/heads/master from Francesco Chicchiriccò
[ https://gitbox.apache.org/repos/asf?p=syncope.git;h=828e72a056 ]

[SYNCOPE-1545] Properly setting Pac4j's client name (#364)



> Web Access
> --
>
> Key: SYNCOPE-1545
> URL: https://issues.apache.org/jira/browse/SYNCOPE-1545
> Project: Syncope
>  Issue Type: New Feature
>  Components: wa
>Reporter: Francesco Chicchiriccò
>Assignee: Francesco Chicchiriccò
>Priority: Major
> Fix For: 3.0.0
>
>
> Web application acting as a central hub for authentication:
>  * dynamically adapting for the configured authentication features (modules, 
> chains, levels, ...) from SYNCOPE-160
>  * highly customizable, either graphically and processing
> Good candidate for building upon appears to be [Apereo 
> CAS|https://apereo.github.io/cas/].



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[GitHub] [syncope] ilgrosso merged pull request #364: [SYNCOPE-1545] Properly setting Pac4j's client name

[GitBox]

ilgrosso merged PR #364:
URL: https://github.com/apache/syncope/pull/364


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@syncope.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org

[GitHub] [syncope] github-code-scanning[bot] commented on a diff in pull request #362: Upgrading Spring Boot to 2.7 and CAS to 6.6

[GitBox]

github-code-scanning[bot] commented on code in PR #362:
URL: https://github.com/apache/syncope/pull/362#discussion_r930879619


##
core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/OIDCJWKSDataBinderImpl.java:
##
@@ -51,22 +58,66 @@
 }
 
 @Override
-public OIDCJWKS create(final int size, final JWSAlgorithm algorithm) {
+public OIDCJWKS create(final String jwksKeyId, final String jwksType, 
final int jwksKeySize) {
+JWK jwk;
 try {
-OIDCJWKS jwks = entityFactory.newEntity(OIDCJWKS.class);
-RSAKey jwk = new RSAKeyGenerator(size).
-keyUse(KeyUse.SIGNATURE).
-keyID(SecureRandomUtils.generateRandomUUID().toString()).
-algorithm(new 
com.nimbusds.jose.JWSAlgorithm(algorithm.name())).
-generate();
-jwks.setJson(JSONObjectUtils.toJSONString(new 
JWKSet(jwk).toJSONObject(false)));
-return jwks;
-} catch (JOSEException e) {
+switch (jwksType.trim().toLowerCase()) {
+case "ec":
+KeyPairGenerator gen = KeyPairGenerator.getInstance("EC");

Review Comment:
   ## Use of a potentially broken or risky cryptographic algorithm
   
   Cryptographic algorithm [EC](1) may not be secure, consider using a 
different algorithm.
   
   [Show more 
details](https://github.com/apache/syncope/security/code-scanning/1120)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@syncope.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org