keycloak / keycloak/keycloak-nodejs-connect

Validate token has key algorithm fixed to RSA-SHA256

Open
#303 1 comment 0 reactions 0 assignees View on GitHub
kind/bug status/triage
Dominant language
JavaScript
Stars
740
Forks
442
PR merge metrics
No merged PRs in 30d

Description

### Describe the bug

The grant manager class has the signature algorithm fixed at RSA-SHA256. You can see that [here](https://github.com/keycloak/keycloak-nodejs-connect/blob/main/middleware/auth-utils/grant-manager.js#L443).

Keycloak allows us to change that algorithm. If I do that, the validate function will reject every token, even if it is valid, because it will attempt to use the wrong algorithm.

### Version

keycloak: 15.0.2
keycloak-connect: 15.0.2

### Expected behavior

Keycloak correctly validates tokens signed with different algorithms

### Actual behavior

Keycloak rejects all tokens except those signed with RSA-SHA256

### How to Reproduce?

Change access token signature algorithm to anything other than RS256, generate a token and attempt to validate using this lib.

### Anything else?

A good fix would be to allow the algorithm to be configurable, and have RSA-SHA256 as the default value to avoid a breaking change.

Contributor guide

Open the contributing guide

Research direction

Start in middleware/auth-utils/grant-manager.js around line 443 and trace how the validate function selects the token signature algorithm. Reproduce the issue with a Keycloak token using an algorithm other than RS256, then verify that configurable algorithms work while RSA-SHA256 remains the default.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.