hashicorp / hashicorp/vault-plugin-auth-jwt

Fail to verify a GitLab JWKS URL

Open
#294 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
107
Forks
73
Avg merge
13h 49m
Merged PRs (30d)
7

Description

An upgrade to Vault `1.16.1` with the plugin version between `v0.19.0` and `v0.20.1` fails to verify a GitLab OIDC url.

Here is a redacted version of the keys :

```json
{
"keys": [{
"kty": "RSA",
"kid": "redacted",
"e": "AQAB",
"n": "redacted",
"use": "sig",
"alg": "RS256"
}, {
"kty": "RSA",
"kid": "redacted",
"e": "AQAB",
"n": "redacted",
"use": "sig",
"alg": "RS256"
}
]
}
```

Here is the error logged when I try to enable a JWKS URL :

```
[ERROR] auth.jwt.auth_jwt_e54f1181: error checking jwks URL: url=https://gitlab.example.com/oauth/discovery/keys error="oidc: malformed jwt: go-jose/go-jose: unexpected signature algorithm \"HS256\"; expected [\"RS256\" \"RS384\" \"RS512\" \"ES256\" \"ES384\" \"ES512\" \"PS256\" \"PS384\" \"PS512\" \"EdDSA\"]"
```

The plugin works fine with the same GitLab instance if we stick with Vault `1.15.4`.

I can provide more informations if required.

Kind regards,

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the failure with the GitLab JWKS URL on Vault 1.16.1 and plugin versions v0.19.0 through v0.20.1, then compare it with Vault 1.15.4. Trace the JWKS URL verification path and the reported unexpected HS256 error; done means the supplied GitLab keys can be verified successfully without regressing supported algorithms.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.