nextcloud / user_oidc

OIDC connect user backend for Nextcloud
GNU Affero General Public License v3.0
82 stars 33 forks source link

Ignore keys using a P-521 curve #868

Open julien-nc opened 4 months ago

julien-nc commented 4 months ago

php-jwt dropped support for P-521 curve. Parsing a keyset which contains a key using this curve will now fail. We could either wait for php-jwt to do something about that. We could also remove this key from the keyset we receive from the IdP.

This is an attempt to fix #823 by removing any key using a P-521 curve from the discovered keys.

The problem I see here is that maybe we are removing a key that we need to decode a token.