spring-projects / spring-projects/spring-security

OpenID Connect Oauth2 Logout Token not using custom jwt alg

Open
#15,273 4 comments 4 reactions 1 assignee View on GitHub

@jzheaux is already working on this.

Since Jun 20, 2024.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
I am trying to make the Back-Channel Logout work with an OIDC client registered with an id_token_signed_response_alg of ES512 but when my OP send the POST request to the client app, I get a com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found exception.
It looks like during the Back-Channel logout flow, the previously defined JwtDecoderFactory is not used to decode the Logout Token.

The Back-Channel logout works just fine when the client application is configured with an id_token_signed_response_alg of RS256 (default algorithm) and the custom JwtDecoderFactory removed.

I am using Spring Security 6.4.0-SNAPSHOT because some things weren't implemented in 6.3.

To Reproduce
Use a back-channel logout with an id_token_signed_response_alg different from RS256 (which is the default)

Expected behavior
The expected behaviour would be to have the back-channel logout work using the same id_token_signed_response_alg as the one for the login process, that was already customized.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.