OIDC Client Fails to Verify Token if JWKS Does Not Define Key Algorithm #586

Description

The process plugins API v2 OIDC client as well as the JWT verifier for the bearer token login and back-channel logout fail to verify access tokens, if the JWK Set resource does not define the key algorithm.

The alg (algorithm) parameter in JSON Web Key (JWK) resources is optional:

4.4. "alg" (Algorithm) Parameter

The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry established by [JWA] or be a value that contains a Collision-Resistant Name. The "alg" value is a case-sensitive ASCII string. Use of this member is OPTIONAL.

The OidcClientJersey and the JwtVerifierImpl (L65), JwtVerifierImpl (L94) uses the alg value from the JWK resource to verify access tokens and fails if the JWK resource does not define the algorithm.

The implementation should likely follow this pseudo code:

jwtAlg = jwt.header.alg
jwtKid = jwt.header.kid

assert jwtAlg is allowed by OIDC client policy

jwk = find issuer JWK matching jwtKid

assert jwk.kty is compatible with jwtAlg

if jwk.alg exists:
assert jwk.alg == jwtAlg

Effected DSF Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.1.0
• 2.1.1