keycloak / keycloak/keycloak-nodejs-connect
Validate token has key algorithm fixed to RSA-SHA256
- Dominant language
- JavaScript
- Stars
- 740
- Forks
- 442
- PR merge metrics
- No merged PRs in 30d
Description
### Describe the bug
The grant manager class has the signature algorithm fixed at RSA-SHA256. You can see that [here](https://github.com/keycloak/keycloak-nodejs-connect/blob/main/middleware/auth-utils/grant-manager.js#L443).
Keycloak allows us to change that algorithm. If I do that, the validate function will reject every token, even if it is valid, because it will attempt to use the wrong algorithm.
### Version
keycloak: 15.0.2
keycloak-connect: 15.0.2
### Expected behavior
Keycloak correctly validates tokens signed with different algorithms
### Actual behavior
Keycloak rejects all tokens except those signed with RSA-SHA256
### How to Reproduce?
Change access token signature algorithm to anything other than RS256, generate a token and attempt to validate using this lib.
### Anything else?
A good fix would be to allow the algorithm to be configurable, and have RSA-SHA256 as the default value to avoid a breaking change.
Contributor guide
Research direction
Start in middleware/auth-utils/grant-manager.js around line 443 and trace how the validate function selects the token signature algorithm. Reproduce the issue with a Keycloak token using an algorithm other than RS256, then verify that configurable algorithms work while RSA-SHA256 remains the default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100