| | | 1 | | <# |
| | | 2 | | .SYNOPSIS |
| | | 3 | | Builds a Private Key JWT (client assertion) for OAuth2/OIDC client authentication. |
| | | 4 | | .DESCRIPTION |
| | | 5 | | This function generates a signed JWT suitable for private_key_jwt client authentication |
| | | 6 | | using either an X509 certificate or a JWK JSON string as the signing key. |
| | | 7 | | |
| | | 8 | | It uses Kestrun.Certificates.CertificateManager.BuildPrivateKeyJwt[FromJwkJson] |
| | | 9 | | under the hood, with: |
| | | 10 | | - iss = client_id |
| | | 11 | | - sub = client_id |
| | | 12 | | - aud = token endpoint |
| | | 13 | | - short lifetime (about 2 minutes) and a random jti. |
| | | 14 | | .PARAMETER Certificate |
| | | 15 | | The X509Certificate2 object whose private key will be used to sign the JWT. |
| | | 16 | | .PARAMETER Path |
| | | 17 | | Path to a certificate on disk. This is resolved via Resolve-KrPath and imported |
| | | 18 | | using [Kestrun.Certificates.CertificateManager]::Import(). |
| | | 19 | | .PARAMETER JwkJson |
| | | 20 | | A JWK JSON string representing the key (typically an RSA private key JWK). |
| | | 21 | | .PARAMETER ClientId |
| | | 22 | | The client identifier; used as both issuer (iss) and subject (sub) in the JWT. |
| | | 23 | | .PARAMETER TokenEndpoint |
| | | 24 | | The token endpoint URL; used as the audience (aud) in the JWT. |
| | | 25 | | .PARAMETER Authority |
| | | 26 | | The authority (issuer) URL; used to discover the token endpoint via OIDC discovery. |
| | | 27 | | .PARAMETER WhatIf |
| | | 28 | | Shows what would happen if the command runs. The command is not run. |
| | | 29 | | .PARAMETER Confirm |
| | | 30 | | Prompts you for confirmation before running the command. The command is not run unless you respond |
| | | 31 | | affirmatively. |
| | | 32 | | .OUTPUTS |
| | | 33 | | [string] – the signed JWT (client assertion). |
| | | 34 | | .EXAMPLE |
| | | 35 | | $cert | New-KrPrivateKeyJwt -ClientId 'my-client' -TokenEndpoint 'https://idp.example.com/oauth2/token' |
| | | 36 | | |
| | | 37 | | Builds a private_key_jwt client assertion using the certificate from the pipeline. |
| | | 38 | | .EXAMPLE |
| | | 39 | | New-KrPrivateKeyJwt -Path './certs/client.pfx' -ClientId 'my-client' ` |
| | | 40 | | -TokenEndpoint 'https://idp.example.com/oauth2/token' |
| | | 41 | | |
| | | 42 | | Imports the certificate from disk and generates a private_key_jwt. |
| | | 43 | | .EXAMPLE |
| | | 44 | | $jwk = ConvertTo-KrJwkJson -Certificate $cert -IncludePrivateParameters |
| | | 45 | | New-KrPrivateKeyJwt -JwkJson $jwk -ClientId 'my-client' ` |
| | | 46 | | -TokenEndpoint 'https://idp.example.com/oauth2/token' |
| | | 47 | | |
| | | 48 | | Generates a private_key_jwt using a private RSA JWK JSON string. |
| | | 49 | | .EXAMPLE |
| | | 50 | | $cert | New-KrPrivateKeyJwt ` |
| | | 51 | | -ClientId 'interactive.confidential' ` |
| | | 52 | | -Authority 'https://demo.duendesoftware.com' |
| | | 53 | | |
| | | 54 | | Uses discovery to resolve the token_endpoint from the authority. |
| | | 55 | | .NOTES |
| | | 56 | | Requires the Kestrun module and the Kestrun.Certificates assembly to be loaded. |
| | | 57 | | #> |
| | | 58 | | function New-KrPrivateKeyJwt { |
| | | 59 | | [KestrunRuntimeApi('Everywhere')] |
| | | 60 | | [CmdletBinding(SupportsShouldProcess = $true, DefaultParameterSetName = 'ByCertificate_Authority')] |
| | | 61 | | [OutputType([string])] |
| | | 62 | | param( |
| | | 63 | | [Parameter(Mandatory = $true, ValueFromPipeline = $true, ParameterSetName = 'ByCertificate_Authority')] |
| | | 64 | | [Parameter(Mandatory = $true, ValueFromPipeline = $true, ParameterSetName = 'ByCertificate_EndPoint')] |
| | | 65 | | [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate, |
| | | 66 | | |
| | | 67 | | [Parameter(Mandatory = $true, ParameterSetName = 'ByJwkJson_Authority')] |
| | | 68 | | [Parameter(Mandatory = $true, ParameterSetName = 'ByJwkJson_EndPoint')] |
| | | 69 | | [string]$JwkJson, |
| | | 70 | | |
| | | 71 | | [Parameter(Mandatory = $true)] |
| | | 72 | | [string]$ClientId, |
| | | 73 | | |
| | | 74 | | [Parameter(Mandatory = $true, ParameterSetName = 'ByJwkJson_EndPoint')] |
| | | 75 | | [Parameter(Mandatory = $true, ParameterSetName = 'ByCertificate_EndPoint')] |
| | | 76 | | [string]$TokenEndpoint, |
| | | 77 | | |
| | | 78 | | [Parameter(Mandatory = $true, ParameterSetName = 'ByJwkJson_Authority')] |
| | | 79 | | [Parameter(Mandatory = $true, ParameterSetName = 'ByCertificate_Authority')] |
| | | 80 | | [string]$Authority |
| | | 81 | | ) |
| | | 82 | | process { |
| | 0 | 83 | | if (-not $PSCmdlet.ShouldProcess("ClientId '$ClientId' to audience '$TokenEndpoint'", 'Generate private_key_jwt' |
| | | 84 | | return |
| | | 85 | | } |
| | 0 | 86 | | $ResolvedTokenEndpoint = if ( -not ([string]::IsNullOrWhiteSpace($Authority))) { |
| | 0 | 87 | | $discoUrl = ($Authority.TrimEnd('/')) + '/.well-known/openid-configuration' |
| | 0 | 88 | | Write-KrLog -Level Debug -Message 'Discovering token endpoint from authority: {authority}' -Values $Authorit |
| | | 89 | | |
| | | 90 | | try { |
| | 0 | 91 | | $meta = Invoke-RestMethod -Uri $discoUrl -Method Get |
| | | 92 | | } catch { |
| | 0 | 93 | | throw "Failed to fetch OIDC discovery document from '$discoUrl': $($_.Exception.Message)" |
| | | 94 | | } |
| | | 95 | | |
| | 0 | 96 | | if (-not $meta.token_endpoint) { |
| | 0 | 97 | | throw "OIDC discovery document from '$discoUrl' does not contain a token_endpoint." |
| | | 98 | | } |
| | | 99 | | |
| | 0 | 100 | | Write-KrLog -Level Debug -Message 'Discovered token endpoint: {tokenEndpoint}' -Values $meta.token_endpoint |
| | 0 | 101 | | [string]$meta.token_endpoint |
| | | 102 | | } else { |
| | 0 | 103 | | $TokenEndpoint |
| | | 104 | | } |
| | | 105 | | |
| | 0 | 106 | | if (-not [string]::IsNullOrWhiteSpace($JwkJson)) { |
| | | 107 | | |
| | 0 | 108 | | Write-KrLog -Level Verbose -Message "Building private_key_jwt from JWK JSON for client '$ClientId'" |
| | 0 | 109 | | return [Kestrun.Certificates.CertificateManager]::BuildPrivateKeyJwtFromJwkJson( |
| | | 110 | | $JwkJson, |
| | | 111 | | $ClientId, |
| | | 112 | | $ResolvedTokenEndpoint |
| | | 113 | | ) |
| | | 114 | | } |
| | | 115 | | |
| | | 116 | | # ByCertificate / ByPath |
| | 0 | 117 | | $cert = $Certificate |
| | | 118 | | |
| | 0 | 119 | | if ($null -eq $cert) { |
| | 0 | 120 | | throw 'Failed to obtain certificate instance.' |
| | | 121 | | } |
| | | 122 | | |
| | 0 | 123 | | if (-not $cert.HasPrivateKey) { |
| | 0 | 124 | | throw 'Certificate does not contain a private key; cannot build a private_key_jwt.' |
| | | 125 | | } |
| | | 126 | | |
| | 0 | 127 | | Write-KrLog -Level Verbose -Message "Building private_key_jwt from certificate for client '$ClientId'" |
| | 0 | 128 | | return [Kestrun.Certificates.CertificateManager]::BuildPrivateKeyJwt( |
| | | 129 | | $cert, |
| | | 130 | | $ClientId, |
| | | 131 | | $TokenEndpoint |
| | | 132 | | ) |
| | | 133 | | } |
| | | 134 | | } |