Revert "Returns token as Proof-of-possession token"

This reverts commit c5608c8.

Author: Prithvi Kanherkar

lib/msal-browser/src/cache/DatabaseStorage.ts

@@ -49,6 +49,7 @@ export class BrowserCrypto {
             modulusLength: keygenConfigModulusLength,
             publicExponent: keygenConfigPublicExponent
         };
+        console.log(this._keygenAlgorithmOptions);
     }
 
     /**
@@ -95,33 +96,6 @@ export class BrowserCrypto {
         return this.hasIECrypto() ? this.msCryptoExportKey(key, format) : window.crypto.subtle.exportKey(format, key);
     }
 
-    /**
-     * Imports key as given KeyFormat, can set extractable and usages.
-     * @param key 
-     * @param format 
-     * @param extractable 
-     * @param usages 
-     */
-    async importKey(key: JsonWebKey, format: KeyFormat, extractable: boolean, usages: Array<KeyUsage>): Promise<CryptoKey> {
-        const keyString = BrowserCrypto.getJwkString(key);
-        const keyBuffer = BrowserStringUtils.stringToArrayBuffer(keyString);
-
-        return this.hasIECrypto() ? 
-            this.msCryptoImportKey(keyBuffer, format, extractable, usages) 
-            : window.crypto.subtle.importKey(format, key, this._keygenAlgorithmOptions, extractable, usages);
-    }
-
-    /**
-     * Signs given data with given key
-     * @param key 
-     * @param data 
-     */
-    async sign(key: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer> {
-        return this.hasIECrypto() ?
-            this.msCryptoSign(key, data)
-            : window.crypto.subtle.sign(this._keygenAlgorithmOptions, key, data);
-    }
-
     /**
      * Check whether IE crypto or other browser cryptography is available.
      */
@@ -169,11 +143,6 @@ export class BrowserCrypto {
         });
     }
 
-    /**
-     * IE Helper function for generating a keypair
-     * @param extractable 
-     * @param usages 
-     */
     private async msCryptoGenerateKey(extractable: boolean, usages: Array<KeyUsage>): Promise<CryptoKeyPair> {
         return new Promise((resolve: any, reject: any) => {
             const msGenerateKey = window["msCrypto"].subtle.generateKey(this._keygenAlgorithmOptions, extractable, usages);
@@ -188,7 +157,7 @@ export class BrowserCrypto {
     }
 
     /**
-     * IE Helper function for exportKey
+     * IE Helper function for exporting keys
      * @param key 
      * @param format 
      */
@@ -218,44 +187,6 @@ export class BrowserCrypto {
         });
     }
 
-    /**
-     * IE Helper function for importKey
-     * @param key 
-     * @param format 
-     * @param extractable 
-     * @param usages 
-     */
-    private async msCryptoImportKey(keyBuffer: ArrayBuffer, format: KeyFormat, extractable: boolean, usages: Array<KeyUsage>): Promise<CryptoKey> {
-        return new Promise((resolve: any, reject: any) => {
-            const msImportKey = window["msCrypto"].subtle.importKey(format, keyBuffer, this._keygenAlgorithmOptions, extractable, usages);
-            msImportKey.addEventListener("complete", (e: { target: { result: CryptoKey | PromiseLike<CryptoKey>; }; }) => {
-                resolve(e.target.result);
-            });
-
-            msImportKey.addEventListener("error", (error: any) => {
-                reject(error);
-            });
-        });
-    }
-
-    /**
-     * IE Helper function for sign JWT
-     * @param key 
-     * @param data 
-     */
-    private async msCryptoSign(key: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer> {
-        return new Promise((resolve: any, reject: any) => {
-            const msSign = window["msCrypto"].subtle.sign(this._keygenAlgorithmOptions, key, data);
-            msSign.addEventListener("complete", (e: { target: { result: ArrayBuffer | PromiseLike<ArrayBuffer>; }; }) => {
-                resolve(e.target.result);
-            });
-
-            msSign.addEventListener("error", (error: any) => {
-                reject(error);
-            });
-        });
-    }
-
     /**
      * Returns stringified jwk.
      * @param jwk 

lib/msal-browser/src/crypto/BrowserCrypto.ts

@@ -2,22 +2,14 @@
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-import { ICrypto, PkceCodes, SignedHttpRequest } from "@azure/msal-common";
+import { ICrypto, PkceCodes } from "@azure/msal-common";
 import { GuidGenerator } from "./GuidGenerator";
 import { Base64Encode } from "../encode/Base64Encode";
 import { Base64Decode } from "../encode/Base64Decode";
 import { PkceGenerator } from "./PkceGenerator";
 import { BrowserCrypto, KeyFormat } from "./BrowserCrypto";
-import { DatabaseStorage } from "../cache/DatabaseStorage";
 import { BrowserStringUtils } from "../utils/BrowserStringUtils";
 
-type CachedKeyPair = {
-    publicKey: CryptoKey,
-    privateKey: CryptoKey,
-    requestMethod: string,
-    requestUri: string
-};
-
 /**
  * This class implements MSAL's crypto interface, which allows it to perform base64 encoding and decoding, generating cryptographically random GUIDs and 
  * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
@@ -34,20 +26,23 @@ export class CryptoOps implements ICrypto {
     private static EXTRACTABLE: boolean = true;
     private static POP_HASH_LENGTH = 43; // 256 bit digest / 6 bits per char = 43
 
-    private static DB_VERSION = 1;
-    private static DB_NAME = "msal.db";
-    private static TABLE_NAME =`${CryptoOps.DB_NAME}.keys`;
-    private _cache: DatabaseStorage<CachedKeyPair>;
-
     constructor() {
         // Browser crypto needs to be validated first before any other classes can be set.
         this.browserCrypto = new BrowserCrypto();
         this.b64Encode = new Base64Encode();
         this.b64Decode = new Base64Decode();
         this.guidGenerator = new GuidGenerator(this.browserCrypto);
         this.pkceGenerator = new PkceGenerator(this.browserCrypto);
-        this._cache = new DatabaseStorage(CryptoOps.DB_NAME, CryptoOps.TABLE_NAME, CryptoOps.DB_VERSION);
-        this._cache.open();
+    }
+
+    async getPublicKeyThumprint(): Promise<string> {
+        const keyPair = await this.browserCrypto.generateKeyPair(CryptoOps.EXTRACTABLE, CryptoOps.POP_KEY_USAGES);
+        // TODO: Store keypair
+        const publicKeyJwk: JsonWebKey = await this.browserCrypto.exportKey(keyPair.publicKey, KeyFormat.jwk);
+        const publicJwkString: string = BrowserCrypto.getJwkString(publicKeyJwk);
+        const publicJwkBuffer: ArrayBuffer = await this.browserCrypto.sha256Digest(publicJwkString);
+        const publicJwkDigest: string = this.b64Encode.urlEncodeArr(new Uint8Array(publicJwkBuffer));
+        return this.base64Encode(publicJwkDigest).substr(0, CryptoOps.POP_HASH_LENGTH);
     }
 
     /**
@@ -80,53 +75,4 @@ export class CryptoOps implements ICrypto {
     async generatePkceCodes(): Promise<PkceCodes> {
         return this.pkceGenerator.generateCodes();
     }
-
-    /**
-     * Generates a keypair, stores it and returns a thumbprint
-     * @param resourceRequestMethod 
-     * @param resourceRequestUri 
-     */
-    async getPublicKeyThumprint(resourceRequestMethod: string, resourceRequestUri: string): Promise<string> {
-        const keyPair = await this.browserCrypto.generateKeyPair(CryptoOps.EXTRACTABLE, CryptoOps.POP_KEY_USAGES);
-        const publicKeyJwk: JsonWebKey = await this.browserCrypto.exportKey(keyPair.publicKey, KeyFormat.jwk);
-        const privateKeyJwk: JsonWebKey = await this.browserCrypto.exportKey(keyPair.privateKey, KeyFormat.jwk);
-        const publicJwkString: string = BrowserCrypto.getJwkString(publicKeyJwk);
-        const publicJwkBuffer: ArrayBuffer = await this.browserCrypto.sha256Digest(publicJwkString);
-        const publicJwkDigest: string = this.b64Encode.urlEncodeArr(new Uint8Array(publicJwkBuffer));
-        const unextractablePrivateKey: CryptoKey = await this.browserCrypto.importKey(privateKeyJwk, KeyFormat.jwk, false, ["sign"]);
-        const publicKeyHash = this.base64Encode(publicJwkDigest).substr(0, CryptoOps.POP_HASH_LENGTH);
-        this._cache.put(publicKeyHash, {
-            privateKey: unextractablePrivateKey,
-            publicKey: keyPair.publicKey,
-            requestMethod: resourceRequestMethod,
-            requestUri: resourceRequestUri
-        });
-        return publicKeyHash;
-    }
-
-    /**
-     * Signs the given object as a jwt payload with private key retrieved by given kid.
-     * @param payload 
-     * @param kid 
-     */
-    async signJwt(payload: SignedHttpRequest, kid: string): Promise<string> {
-        const cachedKeyPair: CachedKeyPair = await this._cache.get(kid);
-        const publicKeyJwk = await this.browserCrypto.exportKey(cachedKeyPair.publicKey, KeyFormat.jwk);
-        const publicKeyJwkString = BrowserCrypto.getJwkString(publicKeyJwk);
-
-        const header = {
-            alg: publicKeyJwk.alg,
-            type: KeyFormat.jwk,
-            jwk: JSON.parse(publicKeyJwkString)
-        };
-
-        const encodedHeader = this.b64Encode.urlEncode(JSON.stringify(header));
-        const encodedPayload = this.b64Encode.urlEncode(JSON.stringify(payload));
-        const tokenString = `${encodedHeader}.${encodedPayload}`;
-        const tokenBuffer = BrowserStringUtils.stringToArrayBuffer(tokenString);
-        const signatureBuffer = await this.browserCrypto.sign(cachedKeyPair.privateKey, tokenBuffer);
-        const encodedSignature = this.b64Encode.urlEncode(BrowserStringUtils.utf8ArrToString(new Uint8Array(signatureBuffer)));
-
-        return `${tokenString}.${encodedSignature}`;
-    }
 }

lib/msal-browser/src/crypto/CryptoOps.ts

@@ -68,19 +68,6 @@ export class BrowserStringUtils {
         return aBytes;      
     }
 
-    /**
-     * Converst string to ArrayBuffer
-     * @param dataString 
-     */
-    static stringToArrayBuffer(dataString: string): ArrayBuffer {
-        const data = new ArrayBuffer(dataString.length);
-        const dataView = new Uint8Array(data);
-        for (let i: number = 0; i < dataString.length; i++) {
-            dataView[i] = dataString.charCodeAt(i);
-        }
-        return data;
-    }
-
     /**
      * Converts Uint8Array to a string
      * @param aBytes 

lib/msal-browser/src/utils/BrowserStringUtils.ts

@@ -2,7 +2,7 @@
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-import { TokenClaims } from "./TokenClaims";
+import { IdTokenClaims } from "./IdTokenClaims";
 import { DecodedJwt } from "./DecodedJwt";
 import { ClientAuthError } from "../error/ClientAuthError";
 import { StringUtils } from "../utils/StringUtils";
@@ -11,39 +11,39 @@ import { ICrypto } from "../crypto/ICrypto";
 /**
  * Id Token representation class. Parses id token string and generates claims object.
  */
-export class JwtToken {
+export class IdToken {
 
     // Raw Id Token string
-    rawToken: string;
+    rawIdToken: string;
     // Claims inside Id Token
-    claims: TokenClaims;
-    constructor(rawToken: string, crypto: ICrypto) {
-        if (StringUtils.isEmpty(rawToken)) {
-            throw ClientAuthError.createTokenNullOrEmptyError(rawToken);
+    claims: IdTokenClaims;
+    constructor(rawIdToken: string, crypto: ICrypto) {
+        if (StringUtils.isEmpty(rawIdToken)) {
+            throw ClientAuthError.createIdTokenNullOrEmptyError(rawIdToken);
         }
 
-        this.rawToken = rawToken;
-        this.claims = JwtToken.extractTokenClaims(rawToken, crypto);
+        this.rawIdToken = rawIdToken;
+        this.claims = IdToken.extractIdToken(rawIdToken, crypto);
     }
 
     /**
      * Extract IdToken by decoding the RAWIdToken
      *
      * @param encodedIdToken
      */
-    static extractTokenClaims(encodedIdToken: string, crypto: ICrypto): TokenClaims {
+    static extractIdToken(encodedIdToken: string, crypto: ICrypto): IdTokenClaims {
         // id token will be decoded to get the username
         const decodedToken: DecodedJwt = StringUtils.decodeJwt(encodedIdToken);
         if (!decodedToken) {
             return null;
         }
         try {
-            const base64TokenPayload = decodedToken.JWSPayload;
+            const base64IdTokenPayload = decodedToken.JWSPayload;
             // base64Decode() should throw an error if there is an issue
-            const base64Decoded = crypto.base64Decode(base64TokenPayload);
-            return JSON.parse(base64Decoded) as TokenClaims;
+            const base64Decoded = crypto.base64Decode(base64IdTokenPayload);
+            return JSON.parse(base64Decoded) as IdTokenClaims;
         } catch (err) {
-            throw ClientAuthError.createTokenParsingError(err);
+            throw ClientAuthError.createIdTokenParsingError(err);
         }
     }
 }