Repository navigation
Conversation
- Consolidated duplicated token validation code in new BaseJwtVerifier. - Added test for BaseJwtVerifier. - JWKS parsing code now supports key_ops property. - Added new properties to configure validation leeway for authentication via bearer tokens and back-channel logout tokens. - JWKS keys are now excepted for token validation if they declare use property with value "sig", declare a key_ops property array that include "verify" value or no use and key_ops properties. - The alg property in JWKS is now optional. Tokens are validated if the JWKS key specifies an algorithm and the token declared the same algorithm. Or if the JWKS key does not specify the algorithm but the token declares RS256, RS384 or RS512 and the key is an RSA key or the token declares ES256, ES384 or ES512 and the key is an EC key. Otherwise the token is rejected without trying a signature validation. fixes #586
issue/586_OIDC_Client_JWKS_Without_Key_Algorithm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Improved OpenId token verification:
BaseJwtVerifier.BaseJwtVerifier.key_opsproperty. The key_ops property is not available to API v2 plugins.useproperty with valuesig, declare akey_opsproperty array that includes averifyvalue or nouseandkey_opsproperties.algproperty in JWKS is now optional. Tokens are validated if the JWKS key specifies an algorithm and the token declared the same algorithm. Or if the JWKS key does not specify the algorithm but the token declaresRS256,RS384orRS512and the key is anRSAkey or the token declaresES256,ES384orES512and the key is anECkey. Otherwise the token is rejected without trying a signature validation.fixes #586