Internal Server Error: JSON::JWK::Set::KidNotFound about omniauth_openid_connect HOT 11 CLOSED

#68 solves the problem, but we must reintroduce signature verification again later.

from omniauth_openid_connect.

I believe nov/json-jwt#92 is the proper fix for this issue.

from omniauth_openid_connect.

I also ran into this issue today, going to revert to 0.3.3 for now

from omniauth_openid_connect.

I think I found the problem:

::OpenIDConnect::ResponseObject::IdToken.decode(id_token, public_key)

public_key is an jwt encoded array of dicts, where each dict represents one key containing a key id. id_token is also an array of dicts. There must be the key id kid named in the id_token.

from omniauth_openid_connect.

Hi,

I just run into this same issue while using 0.3.3...
Does that makes sense to you ? Could it be not related to this issue ?
I have pretty much the same stacktrace as @tobiashuste

from omniauth_openid_connect.

Hi,

I just run into this same issue while using 0.3.3...
Does that makes sense to you ? Could it be not related to this issue ?
I have pretty much the same stacktrace as @tobiashuste

No, this must be something else. Is there an error "KidNotFound"?

from omniauth_openid_connect.

yep, same stacktrace as the one posted up there..

from omniauth_openid_connect.

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

from omniauth_openid_connect.

We solved this issue on our Gitlab instance by switching the ID token signature method to RS256 instead of HS256 in our OP configuration.

It is normal for JWT signed with HS* to not have a kid because they are unambiguously signed by the client secret in the context of OpenID Connect. The lack of kid should not be a fatal error.

from omniauth_openid_connect.

Got some feedback from the json-jwt maintainer, and this is another attempt at fixing this issue: #91

from omniauth_openid_connect.

@stanhu Is the fix you provided for this issue in #91 or nov/json-jwt#92 expected to get merged & released? Both maintainers don't seem very willing nor active 😦
Should we switch to the Gitlab fork? In case of the latter, is there any Omniauth 2.x support planned for that fork?

from omniauth_openid_connect.