search

doorkeeper-gem / doorkeeper-openid_connect

OpenID Connect extension for Doorkeeper
MIT License
175 stars 117 forks source link

Default to RFC 7638 kid fingerprint generation #194

Closed stanhu closed 1 year ago

stanhu commented 1 year ago

The switch from the json-jwt to jwt gem in #177 changed the default kid generation from RFC 7638 (https://www.rfc-editor.org/rfc/rfc7638) to a format based on the SHA256 digest of the key elements.

However, clients may fail if the the kid generated by IdToken does not match a key listed in JWKS discovery endpoint, which may be implemented by the application using RFC 7638-based kid values. To restore the previous behavior, applications have to set a global setting:

JWT.configuration.jwk.kid_generator_type = :rfc7638_thumbprint

However, relying on this global setting is not ideal since other keys may depend on the legacy kid values.

In keeping with semantic versioning, restore the kid generation to RFC 7638. Whether this should be customizable can be discussed later.

Closes #193

stanhu commented 1 year ago

Failing tests will be fixed by https://github.com/doorkeeper-gem/doorkeeper-openid_connect/pull/195.

jessieay commented 1 year ago

Thank you for the detailed explanation on these kid formats @stanhu ! TIL RFC 7638 exists :)

stanhu commented 1 year ago

@nbulaj Could you also take a look at this one?

nbulaj commented 1 year ago

Released with 1.8.6