Multiple keys support in the jwks_uri url about doorkeeper-openid_connect HOT 5 OPEN

If you are including a kid in your jwt access token, then make sure it is generated the same way that doorkeeper-open_id_connect generates it's kid in the jwks_uri.

For those curious, the following worked for me:

   token_headers do |opts|
      key = OpenSSL::PKey.read File.read('<private_key>.pem')
      { kid: JSON::JWK.new(key)[:kid] }
    end

from doorkeeper-openid_connect.

@janz93 thanks for raising this issue!

1. Yes this should be possible in principle, as the jwks_uri responds with a keys: [] array.
2. Not sure, I'm not familiar with the doorkeeper-jwt gem or how JWTs are used in OAuth outside of an OIDC context. It sounds like it would make sense to have doorkeeper-jwt as a dependency so the configuration could be shared. Note that it's currently not needed if you just want to use doorkeeper-openid_connect, we do our own JWT setup in this gem.

from doorkeeper-openid_connect.

@toupeira thank you for your response. Regarding the second point. I think since both gems are doing their own JWT setup a solution can not be found here in this issue. For the first point if possible I would like to take on this enhancement and create a PR with a possible solution for it.

from doorkeeper-openid_connect.

For the first point if possible I would like to take on this enhancement and create a PR with a possible solution for it.

@janz93 Sure that would be awesome! The only thing you have to watch out for is to still support a non-array value in existing configurations.

Regarding the second point. I think since both gems are doing their own JWT setup a solution can not be found here in this issue.

Yeah I guess there would be ways to do it, but not very cleanly 😉

from doorkeeper-openid_connect.

@janz93 We got around this by using the same key pair for doorkeeper-jwt as we did for doorkeeper-open_id_connect. If you are including a kid in your jwt access token, then make sure it is generated the same way that doorkeeper-open_id_connect generates it's kid in the jwks_uri

With that said, we would like to be able to rotate the keys that are used to sign the jwt access token / id token and be able to have the jwks_uri include the old public key as well as the newer one.

from doorkeeper-openid_connect.