search

coreos / go-oidc

A Go OpenID Connect client.
Apache License 2.0
1.92k stars 393 forks source link

id token signed with unsupported algorithm Error (error at traefik-forward-auth) #429

Closed AdriDevelopsThings closed 4 months ago

AdriDevelopsThings commented 4 months ago

I'm trying to verify a oidc token but I get the following error: id token signed with unsupported algorithm, expected [\"RS256\"] got \"ES256\". The openid-configurations key id_token_signing_alg_values_supported is ["ES256"]. The library should automatically recognize the algorithm.

go-oicd version: v2.2.1

Context: I'm using traefik-forward-auth what is using this library. They verify the token here: https://github.com/thomseddon/traefik-forward-auth/blob/master/internal/provider/oidc.go#L88. I'm not sure if the bug is in traefik-forward-auth or in go-oidc but I guess you can see the problem faster.

I already found this issue but traefik-forward-auth uses Verifier instead of NewVerifier. There is someone at traefik-forward-auth who has the same problem than me (https://github.com/thomseddon/traefik-forward-auth/issues/358) but the supported algorithms should be recognized by this library automatically instead of adding them manually I guess.

ericchiang commented 4 months ago

The algorithms should already be detected through the id_token_signing_alg_values_supported key in discovery.

https://github.com/coreos/go-oidc/blob/22dfdcabd450013b4d51ac15b6423f529d957e9f/oidc/oidc.go#L138 https://github.com/coreos/go-oidc/blob/22dfdcabd450013b4d51ac15b6423f529d957e9f/oidc/oidc.go#L242-L255 https://github.com/coreos/go-oidc/blob/22dfdcabd450013b4d51ac15b6423f529d957e9f/oidc/verify.go#L138-L144

What provider are you attempting to use this with? Do you have their discovery doc?

AdriDevelopsThings commented 4 months ago

I'm using https://kanidm.github.io/. You can take a look to my openid configuration here.

ericchiang commented 4 months ago

Thanks! I was able to reproduce #430

Will get a fix in a sec

ericchiang commented 4 months ago

Actually, there was a bug in my test. With an e2e program, I'm not able to reproduce. The program appears to be correctly reading the ES256 algorithm

AdriDevelopsThings commented 4 months ago

Thanks for your help but I found the problem: I was just using an old version of traefik-forward-auth. The current version works for me.