Support additional JWT signing algorithms (ES256/ES384/ES512, PS256, etc.) for OpenID Connect login
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 40.9k
- Forks
- 5.4k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 202
Description
ToolJet's OpenID Connect login currently only accepts ID tokens signed with RS256. When the upstream IdP signs tokens with any other algorithm permitted by the OIDC spec, login fails with:
Open ID login failed - unexpected JWT alg received, expected RS256, got: ES384
This blocks integration with IdPs that have moved to ECDSA-based signing (ES256/ES384/ES512) for better performance and shorter keys, or to RSA-PSS (PS256/PS384/PS512). ES* algorithms in particular are increasingly the default in modern IdP deployments and are mandatory-to-implement for OIDC conformance in several profiles.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the OpenID Connect login flow and the JWT algorithm validation that produces the RS256 error. Reproduce the failure with an ES384-signed token, then verify login with the requested ES256/ES384/ES512 and PS256/PS384/PS512 algorithms while preserving rejection of unsupported algorithms.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100