Open dutta-arnab1 opened 4 months ago
For your first option (supporting config of multiple algorithms), the library (openid-client) we provide the config to also doesn't support multiple values. It may be worth creating an issue with that library as well.
The alternative to that would be complicated: supporting multiple instances of the library (clients) in this SDK. That sounds like a worse solution than having openid-client implement it.
I agree, the alternative is not an option at all. So unless openid-client
provides that option, there's nothing much we can do here.
Thanks @madaster97 for looking into this.
Checklist
Describe the problem you'd like to have solved
We use
express-openid-connect
library for performingAuthorization Code
flow login from a Node.js Express server. The purpose of this server is to enforce the user to be authenticated before we serve the actual web application.A recent change in the private hosted organization level IDP had changed the default ID Token algorithm from
RS256
toPS256
. We could resolve the problem just by loading the discovery document and set the first value in theid_token_signing_alg_values_supported
array from discovery document into the config ofexpress-openid-connect -> auth middleware -> idTokenSigningAlg
.However, the IDP team has announced that they would be supporting multiple ID Token algorithm and would rotate between them. So, the ID Token that would get generated could be signed with one of few defined algorithms.
I could not find a way to make it work with this library.
idTokenSigningAlg
receives only one algorithm.kid
andalgorithm
out of JWT header and validate it against JWKS endpoint.Describe the ideal solution
Either of the three options mentioned would be nice to have.
idTokenSigningAlg
supporting an array of algorithms to be configured.kid
andalgorithm
out of JWT header and validate it against JWKS endpoint.Alternatives and current workarounds
No response
Additional context
No response