Support JWT for Client Authentication

[jgrandja]

This feature will partially implement JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants.

Section 2.2. Using JWTs for Client Authentication will be the focus for this feature implementation.

NOTE: This ticket addresses client-side support only.

Related #6881 #6053

Cool. Authenticating with Azure AD using a certificate uses this flow, afaics. This feature will help us executing that flow cleanly. Thx.

[thomas-corte]

I believe that this would also provide better support for "Sign In With Apple", as Apple uses a non-static client secret, which in their case must be the string representation of a JWT (seemingly compliant with the JWT profile covered in the issue) with an expiration date of at most 6 months in the future (see https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens).

[jgrandja]

@thomas-corte Thanks for pointing that out. Indeed, Apple does support private_key_jwt client authentication so this feature will be needed.

FYI, we are targeting this for 5.5 but we're dependent on merging #9208 first, which we are getting close.

[thomas-corte]

Not sure whether this helps (as #9208 seems to aim at using the Nimbus libraries), but for comparison, I was able to successfully create a working secret for Apple using this code (which utilizes BouncyCastle and the io.jsonwebtoken library):

import java.util.Date;
import java.util.HashMap;
import java.util.Map;

import java.io.Reader;
import java.io.StringReader;

import java.security.Key;
import java.security.PrivateKey;

import io.jsonwebtoken.JwtBuilder;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;

import org.bouncycastle.openssl.PEMParser;

import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;

...

JwtBuilder jwtBuilder = Jwts.builder ();

String keyBase64 = "-----BEGIN PRIVATE KEY-----\n" +
  "<base64 encoded private key data from Apple>" +
  "-----END PRIVATE KEY-----";

final Reader pemReader = new StringReader (keyBase64);
final PEMParser pemParser = new PEMParser (pemReader);
final JcaPEMKeyConverter converter = new JcaPEMKeyConverter ();

final PrivateKeyInfo object = (PrivateKeyInfo) pemParser.readObject ();
final PrivateKey pKey = converter.getPrivateKey (object);

Map<String, Object> headers = new HashMap<> ();
headers.put ("kid", "WTXXXXXX"); // Key ID from Apple
headers.put ("alg", "ES256");
jwtBuilder.setHeader (headers);

String clientSecret = jwtBuilder.
  setIssuer ("KVXXXXXXXX"). // Team ID from Apple
  setIssuedAt (new Date (System.currentTimeMillis ())).
  setExpiration (new Date (System.currentTimeMillis () + 180l * 86_400_000l)). // 6 months max
  setAudience ("https://appleid.apple.com").
  setSubject ("com.my.app.name").
  signWith (SignatureAlgorithm.ES256, pKey).compact ();

[jgrandja]

Thanks for the sample @thomas-corte. We will be using Nimbus for implementation.