CODEWITHSUNDEEP
oracle-databaseosb
Hriday Tiwari
Hriday Tiwari

Reputation: 1

OAM 12c OAuth Access token validation

I am trying to set up OAM 12c for implementing OAuth with default setup. Seeking your help to resolve signature related issue.

Issue - Caused by: java.security.SignatureException: Signature length not correct: got 256 but was expecting 128

Use Case – Locally validating OAM 12c Access Token by using OAM Certificates for implementing OAuth (2 leg flow)

Description - OSB (Oracle Service Bus) is a oracle product to implement REST services and secure services using OWSM product. A UI application (for simulation we are using SOAP UI), will call this REST service and pass the JWT Token as a Bearer token(token generated by calling OAM 12c REST API) OSB should validate the token using the certificates of OAM.

Steps performed - 1. Imported the OAM certificates(under fmwconfig/defaultkeystore alias orakey) in OWSM default key store and as per oracle documentation it should validate the incoming JWT access token locally using OAM Certifcates. 2. Created Identity domain, Resource Server and Client using OAM API 3. Created token by calling OAM API 4. Passing this token to OSB REST API 5. Token Validation failed with below exception in OSB logs.

The exception we are receiving is – 

Caused by: java.security.SignatureException: Signature length not correct: got 256 but was expecting 128
              at sun.security.rsa.RSASignature.engineVerify(RSASignature.java:189)
              at java.security.Signature$Delegate.engineVerify(Signature.java:1219)
              at java.security.Signature.verify(Signature.java:652)
              at oracle.security.restsec.jwt.JwtToken.verify(JwtToken.java:1558)

I have verified, the token generated at OAM12c is RSA256 with RSASHA256 signature, but looks like OSB (12.2.1.3.0) is unable to consume the same, please let know your inputs and help resolve this.

Upvotes: 0

Views: 2506

Answers (1)

Mayank Maria
Mayank Maria

Reputation: 156

It looks to me that, the problem lies in using incorrect certificate for signature validation.

In OAM 12c, every OAuth Domain created has its own set of public-private key pair (certificates). These certificates are not stored under fmwconfig/defaultkeystore alias orakey.

On latest 12cPS3 Bundle patch, try the following URL to fetch the OAuth domain certificate.

curl -X GET "http://{managed server host}:{managed server port}/oauth2/rest/security" -H 'authorization: Basic ...' -H 'X-OAUTH-IDENTITY-DOMAIN-NAME: <OAuth Domain Name>'

where Basic authorization header contains - B64 encoded "OAuth Client ID:password"

The response will be in JSON Web Key Specification i.e. RFC 7517.

Upvotes: 0

Related Questions