Fetch key from JWKS URI if available #133
Conversation
stanhu
force-pushed
the
sh-fetch-jwks-uri
branch
2 times, most recently
from
ceda8f5 to
63417c7
Compare
|
@jessieay @bufferoverflow Could you review this? |
| key_or_secret | ||
| elsif client_options.jwks_uri | ||
| fetch_key | ||
| end |
There was a problem hiding this comment.
Question: should there be an else option here that returns config.jwks?
Previous logic would return config.jwks if options.discovery but also fell back to config.jwks if key_or_secret were nil.
In addition to adding fetch_key, we are changing the fallback/default behavior here, which could have unintended / backward incompatible consequences.
What do you think?
There was a problem hiding this comment.
@jessieay It's a good question, but config always attempts to call out to the OpenID discovery URL, which should not happen if discovery is disabled.
There was a problem hiding this comment.
ah ok that makes sense @stanhu . In other words: the former default return value was problematic and what we are fixing 💯
|
@Azure Is this correct ? Azure B2C, discovery does not work because the discovery URL does not match the issuer field and therefore being non-standard OpenID Connect? |
|
@bufferoverflow FYI, the Azure non-compliance has been discussed in other issues: |
In non-standard OpenID Connect providers, such as Azure B2C, discovery does not work because the discovery URL does not match the issuer field. If a JWKS URI is provided when discovery is disabled, we should make an HTTP request for the keys and use the response. Closes #72
stanhu
force-pushed
the
sh-fetch-jwks-uri
branch
from
63417c7 to
cd28cc2
Compare
In non-standard OpenID Connect providers, such as Azure B2C, discovery
does not work because the discovery URL does not match the issuer field.
If a JWKS URI is provided when discovery is disabled, we should make an
HTTP request for the keys and use the response.
Closes #72
This is part of the effort to upstream changes in the GitLab fork: https://gitlab.com/gitlab-org/ruby/gems/gitlab-omniauth-openid-connect/-/issues/5.