fix(DiscoveryService): Handle Missing kid

[solracsf]

Possible fix for #1214

• Prefer matching kid if present
• Otherwise, select the first key compatible with the expected kty

Testing Notes (not in this PR):

• Recommend adding future PHPUnit tests with various JWT and JWKS combinations, including kid present/absent and multiple key types (RSA, EC, OKP).

[julien-nc]

Lgtm. Thanks a lot!
I'll rebase and merge.

[joshtrichards]

Is the supported algorithm list being used by this new check complete / up-to-date?

Looks like it may be missing EdDSA:

https://help.nextcloud.com/t/updated-openid-connect-breaks-using-eddsa-algo/234499

https://www.rfc-editor.org/rfc/rfc8037

[whisperdancer]

Any movement forward on fixing this? Thanks

[joshtrichards]

@whisperdancer #1236 + #1254 should fix the matter. If you're able to test, that would be appreciated. Comment on #1254 with your results.

[whisperdancer]

Thanks @joshtrichards. I checked for app update and none available. Happy to test it, but unsure how to get the fix without an app update. Kindly advise. Thank you.

[joshtrichards]

Until release you'd have to apply the patch(es) manually from the PRs to the app:

https://docs.nextcloud.com/server/latest/admin_manual/issues/applying_patch.html

[solracsf]

@whisperdancer new app version is out.
Create an issue if needed, thanks 👍🏼

[whisperdancer]

Thank you! Tested and works great now :) Much appreciate the quick fix!!