Statically configured keys (OIDCOAuthVerifyCertFiles) not used for validating signature on id_token

[madsfreek]

Hi Hans

I'm trying to use a statically configured key (OIDCOAuthVerifyCertFiles - i.e. a PEM encoded certificate) to validate the signature on an id_token.

The debug output is:

src/proto.c(1555): oidc_proto_jwt_verify: "jwks_uri" is not set, signature validation will only be performed against statically configured keys
oidc_proto_jwt_verify: JWT signature verification failed: [src/jose.c:1018: oidc_jwt_verify]: could not verify signature against any of the (0) provided keys; you have probably provided no or incorrect keys/key-types for algorithm: RS256
oidc_proto_parse_idtoken: id_token signature could not be validated, aborting, referer: https://wayf.wayf.dk/

If I configure the same key - in jwks format - using OIDCOAuthVerifyJwksUri it works fine :)

Is that a feature or a bug?

-Mads

[zandbelt]

Hey Mads! :-) OIDCOAuthVerifyCertFiles is for verifying access tokens in an OAuth 2.0 RS setup. For explicit configuration of ID token validation keys, you can only use OIDCProviderJwksUri (note, NOT OIDCOAuthVerifyJwksUri which is for OAuth 2.0 RS again...) but you could point it to a locally hosted script that converts PEM to JWKs

[madsfreek]

Hi Hans - thanks for your prompt answer :)

I am actually using OIDCProviderJwksUri - writing OIDCOAuthVerifyJwksUri was a copy-paste error.

I am trying to do a SAML like set up i.e. not base the trust on TLS, but that seems impossible? Not even embedding the key in metadata is allowed - jwks_uri has to be a https url.

[zandbelt]

that is the default setup indeed; embedding the key is not possible, but you could a) host the key (as JWKs) on the same Apache server, assuming it has a valid TLS cert and you do not see that as problematic, or b) host the key (as JWKs) on a HTTPs server that has a locally issued certificate configured and configure OIDCCABundlePath to trust it, or c) provide a PR to add support for a statically configured key (though it would also have to enforce returning and validating JWTs from the user info endpoint, or avoid using that)

[madsfreek]

Thanks again - I will see if I can manage a PR ...

[zandbelt]

@madsfreek please try this branch
https://github.com/zmartzone/mod_auth_openidc/tree/static-idtoken-verification-keys
docs here:
https://github.com/zmartzone/mod_auth_openidc/blob/static-idtoken-verification-keys/auth_openidc.conf#L68-L74
and provide your feedback, thanks

[zandbelt]

now published as part of release 2.4.12.3, see: https://github.com/zmartzone/mod_auth_openidc/releases/tag/2.4.12.3