The MSAL library for Go is part of the Microsoft identity platform for developers (formerly named Azure AD) v2.0. It enables you to acquire security tokens to call protected APIs. It uses industry standard OAuth2 and OpenID Connect.
MIT License
218
stars
87
forks
source link
[Feature Request] AAD client assertions should be computed using SHA 256 and an approved padding scheme #471
When MSAL creates the client assertion, it uses PKCS1 padding for digital signature and SHA1 as x5t claim. These are old crypto algorithms and we need to move to newer versions. The STS is building support.
MSAL client type
Confidential
Problem Statement
When MSAL creates the client assertion, it uses PKCS1 padding for digital signature and SHA1 as x5t claim. These are old crypto algorithms and we need to move to newer versions. The STS is building support.
See ESTS work items :
https://identitydivision.visualstudio.com/Engineering/_workitems/edit/2655345 https://identitydivision.visualstudio.com/Engineering/_workitems/edit/2704466
Proposed solution
Use x5t#s256 and PSS padding when talking to ESTS, CIAM, B2C(?) but not with ADFS.
Original issue
https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4428