hashicorp / hashicorp/vault-plugin-auth-jwt
Fail to verify a GitLab JWKS URL
- Dominant language
- Go
- Stars
- 107
- Forks
- 73
- Avg merge
- 13h 49m
- Merged PRs (30d)
- 7
Description
An upgrade to Vault `1.16.1` with the plugin version between `v0.19.0` and `v0.20.1` fails to verify a GitLab OIDC url.
Here is a redacted version of the keys :
```json
{
"keys": [{
"kty": "RSA",
"kid": "redacted",
"e": "AQAB",
"n": "redacted",
"use": "sig",
"alg": "RS256"
}, {
"kty": "RSA",
"kid": "redacted",
"e": "AQAB",
"n": "redacted",
"use": "sig",
"alg": "RS256"
}
]
}
```
Here is the error logged when I try to enable a JWKS URL :
```
[ERROR] auth.jwt.auth_jwt_e54f1181: error checking jwks URL: url=https://gitlab.example.com/oauth/discovery/keys error="oidc: malformed jwt: go-jose/go-jose: unexpected signature algorithm \"HS256\"; expected [\"RS256\" \"RS384\" \"RS512\" \"ES256\" \"ES384\" \"ES512\" \"PS256\" \"PS384\" \"PS512\" \"EdDSA\"]"
```
The plugin works fine with the same GitLab instance if we stick with Vault `1.15.4`.
I can provide more informations if required.
Kind regards,
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the failure with the GitLab JWKS URL on Vault 1.16.1 and plugin versions v0.19.0 through v0.20.1, then compare it with Vault 1.15.4. Trace the JWKS URL verification path and the reported unexpected HS256 error; done means the supplied GitLab keys can be verified successfully without regressing supported algorithms.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100