Repository: privacyidea/privacyidea

Issue:
Only use trusted algorithm with TRUSTED_JWT
While validating trusted JWTs in ``verify_auth_token()``, the same public key can
be used with more than one externally specified encryption algorithm as long as
it is included in the `TRUSTED_JWT_ALGOS` list.

~~~~python
  for trusted_jwt in trusted_jwts:
    try:
    if trusted_jwt.get("algorithm") in TRUSTED_JWT_ALGOS:
        j = jwt.decode(auth_token,
            trusted_jwt.get("public_key"),
            algorithms=TRUSTED_JWT_ALGOS)
~~~~

We should only do:

     algorithms=trusted_jwt.get("algorithm")



Discussion:

Resolving patch:
diff --git a/privacyidea/api/lib/utils.py b/privacyidea/api/lib/utils.py
--- a/privacyidea/api/lib/utils.py
+++ b/privacyidea/api/lib/utils.py
@@ -300,7 +300,7 @@ def verify_auth_token(auth_token, required_role=None):
                 if trusted_jwt.get("algorithm") in TRUSTED_JWT_ALGOS:
                     j = jwt.decode(auth_token,
                                    trusted_jwt.get("public_key"),
-                                   algorithms=TRUSTED_JWT_ALGOS)
+                                   algorithms=[trusted_jwt.get("algorithm")])
                     if dict((k, j.get(k)) for k in ("role", "resolver", "realm")) == \
                             dict((k, trusted_jwt.get(k)) for k in ("role", "resolver", "realm")):
                         if re.match(trusted_jwt.get("username") + "$", j.get("username")):
diff --git a/tools/privacyidea-decrypt-safeword.py b/tools/privacyidea-decrypt-safeword.py
deleted file mode 100755
--- a/tools/privacyidea-decrypt-safeword.py
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-#
-# (c) Cornelius Kölbel
-# Info: http://www.privacyidea.org
-
-from __future__ import print_function
-import argparse
-import re
-from Crypto.Cipher import AES, DES
-import binascii
-
-parser = argparse.ArgumentParser()
-parser.add_argument("-f", "--file", help="LDIF export file.", required=True)
-
-args = parser.parse_args()
-
-all_tokens = []
-current_token = {}
-aes_key = "encryptionkey"
-des_key = "encryoptionkey"
-
-with open(args.file, 'r') as f:
-    for line in f:
-        if re.match("objectclass: SccDesAuthenticator.*", line):
-            current_token = {}
-        if re.match("sccAuthenticatorId", line):
-            m = re.match("sccAuthenticatorId:(.*)$", line)
-            serial = m.group(1).strip()
-            current_token["serial"] = serial
-
-        if re.match("sccTokenData", line):
-            m = re.search("sccKey=\((.*?)\).*", line)
-            if m:
-                seed = m.group(1)
-                algo, data = seed.split(":")
-                current_token["algo"] = algo
-                current_token["data"] = data
-
-                if algo.lower() == "aes":
-                    aes = AES.new(aes_key, AES.MODE_ECB)
-                    d = aes.decrypt(binascii.unhexlify(data))
-                    current_token["seed"] = d.strip("\x00")
-
-                elif algo.lower() == "des":
-                    des = DES.new(des_key)
-                    d = des.decrypt(binascii.unhexlify(data))
-                    current_token["seed"] = d.strip("\x00")
-            else:
-                print("Could not find key for token! {0}".format(line))
-
-        if "serial" in current_token and "data" in current_token:
-            all_tokens.append(current_token)
-            current_token = {}
-
-
-for token in all_tokens:
-    print("{0!s}, {1!s}".format(token.get("serial"), token.get("seed")))


Test patch: