Token without kid but jwks contains key id

[ahoeing]

Hi sda-commons developers,

I am currently faced with the following situation.
The issued key has no kid header (but only x5t) defined, but the kid is included in the JKWS, provided by the identity provider.

Due to this line:

sda-dropwizard-commons/sda-commons-server-auth/src/main/java/org/sdase/commons/server/auth/service/AuthService.java

Line 42 in 290f65a

String keyId = JWT.decode(authorizationToken).getKeyId();

I cannot validate the token. Is it mandatory that if the token has no kid, then the key must also have no key id or is it ok to be more flexible here, e.g. check against all known keys is keyid is not given?

Thanks

[JoergSiebahn]

As a quick fix, you may configure the key as PEM.

Does your token have any other indication of the used key, e.g. an iss claim?

I'm not sure about all implications, but at first sight, it feels wrong to try any key for validation. But it could be an option to try any key of a defined issuer.

[ahoeing]

Yes, I know that workaround but I need a sustainable solution.
It has an x5t info in it's header. x5t is the fingerprint of the certificate.

[JoergSiebahn]

Would it be possible to use that fingerprint to identify the public key directly or in the JWKS?

[ahoeing]

yes. We would have to extend the sda-commons implementation to configure the key identifier.

[JoergSiebahn]

Solved in #2546