Access tokens use algo 'PS256' which seems not to be supported/implemented by any token verifier .... about konnect HOT 7 CLOSED

Thanks for your feedback!

I tried to verify the token using various verification libraries and non of them understands PS256.

This is sad for them, since PS256 is pretty much the way to go if you want to avoid potentially insecure RSA PKCS#1 signatures with keys with low exponent (Bleichenbacher).

Is there a config option to change this?

Yes.

      --signing-method string                 JWT signing method (default "PS256")            

as command line argument when starting Konnect. It defines what algorithm is used.

For RSA keys you can switch to any of the PKCS#1 based variants (RS256,RS384,RS512). Konnect also supports ECDSA keys with ES256,ES384,ES512).

from konnect.

Switching to RS256 fixes this. THX for now - let's see what needs to be done these days to support PS256.

Its a valid workaround. Konnect will refuse to start with a RSA key with low exponent anyways (see

I doubt that there are still SSL libraries out there who generate such keys when using their default settings. So should be good enough to use RS256 in production.

from konnect.

THX a lot @longsleep - I'll give that a try ....

from konnect.

THX a lot @longsleep - I'll give that a try ....

You are welcome. You seem to use okta-jwt-verifier-php which either uses spomky-labs/jose or firebase/php-jwt where firebase/php-jwt does not support RSA-PSS but spomky-labs/jose does (according to their docs at https://packagist.org/packages/spomky-labs/jose). Maybe you can use spomky-labs/jose?

from konnect.

You are welcome. You seem to use okta-jwt-verifier-php which either uses spomky-labs/jose or firebase/php-jwt where firebase/php-jwt does not support RSA-PSS but spomky-labs/jose does (according to their docs at https://packagist.org/packages/spomky-labs/jose). Maybe you can use spomky-labs/jose?

No idea why but they seem to only allow RS256 - no idea why.
https://github.com/okta/okta-jwt-verifier-php/blob/1cef6069221c31607806b54b7d36bd610aecaa13/src/Adaptors/SpomkyLabsJose.php#L36

But even if i set this to PS256 it does not verify the token.

from konnect.

No idea why but they seem to only allow RS256 - no idea why.

Raised okta/okta-jwt-verifier-php#24

from konnect.

Switching to RS256 fixes this. THX for now - let's see what needs to be done these days to support PS256.

from konnect.