diff --git a/packages/core/src/env-set/oidc.test.ts b/packages/core/src/env-set/oidc.test.ts index df1e18adb1c..e86c2ae915d 100644 --- a/packages/core/src/env-set/oidc.test.ts +++ b/packages/core/src/env-set/oidc.test.ts @@ -17,20 +17,28 @@ describe('oidc env-set', () => { jest.resetModules(); }); - it('should read OIDC private keys if `OIDC_PRIVATE_KEYS` is provided', async () => { - process.env.OIDC_PRIVATE_KEYS = 'foo, bar'; + it('should read OIDC private keys if raw `OIDC_PRIVATE_KEYS` is provided', async () => { + const rawKeys = [ + '-----BEGIN PRIVATE KEY-----\nFOO\n-----END PRIVATE KEY-----', + '-----BEGIN PRIVATE KEY-----\nBAR\n-----END PRIVATE KEY-----', + ]; + process.env.OIDC_PRIVATE_KEYS = rawKeys.join(','); const privateKeys = await readPrivateKeys(); - expect(privateKeys).toEqual(['foo', 'bar']); + expect(privateKeys).toEqual([ + '-----BEGIN PRIVATE KEY-----\nFOO\n-----END PRIVATE KEY-----', + '-----BEGIN PRIVATE KEY-----\nBAR\n-----END PRIVATE KEY-----', + ]); }); - it('should read OIDC private keys if provided `OIDC_PRIVATE_KEYS` contain newline characters', async () => { - process.env.OIDC_PRIVATE_KEYS = 'foo\nbar, bob\noop'; + it('should transpile and read OIDC private keys if base64-formatted `OIDC_PRIVATE_KEYS` is provided', async () => { + const base64Keys = ['foo', 'bar'].map((key) => Buffer.from(key, 'utf8').toString('base64')); + process.env.OIDC_PRIVATE_KEYS = base64Keys.join(','); const privateKeys = await readPrivateKeys(); - expect(privateKeys).toEqual(['foo\nbar', 'bob\noop']); + expect(privateKeys).toEqual(['foo', 'bar']); }); it('should read OIDC private keys if `OIDC_PRIVATE_KEY_PATHS` is provided', async () => { diff --git a/packages/core/src/env-set/oidc.ts b/packages/core/src/env-set/oidc.ts index 45189c24d0b..33b713ee895 100644 --- a/packages/core/src/env-set/oidc.ts +++ b/packages/core/src/env-set/oidc.ts @@ -15,6 +15,8 @@ const defaultLogtoOidcPrivateKeyPath = './oidc-private-key.pem'; const listFormatter = new Intl.ListFormat('en', { style: 'long', type: 'conjunction' }); +const isBase64FormatPrivateKey = (key: string) => !key.includes('-'); + /** * Try to read private keys with the following order: * @@ -30,7 +32,13 @@ export const readPrivateKeys = async (): Promise => { const privateKeys = getEnvAsStringArray('OIDC_PRIVATE_KEYS'); if (privateKeys.length > 0) { - return privateKeys; + return privateKeys.map((key) => { + if (isBase64FormatPrivateKey(key)) { + return Buffer.from(key, 'base64').toString('utf8'); + } + + return key; + }); } const privateKeyPaths = getEnvAsStringArray('OIDC_PRIVATE_KEY_PATHS');