Custom RemoteKeySet for Azure appid specific key url
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 431
- Forks
- 179
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 71
Description
Is your feature request related to a problem? Please describe.
JWT signature verification doesn't work when Azure generates app specific signing keys.
Describe the solution you'd like
The appid paramater has to be applied to the keys url.
Example from coreos oidc:
https://github.com/coreos/go-oidc/issues/215
keys := oidc.NewRemoteKeySet(ctx, "https://login.microsoftonline.com/foo/discovery/v2.0/keys?appid=6731de76-14a6-49ae-97bc-6eba6914391e")
cfg := &oidc.Config{ClientID: clientID}
verifier := oidc.NewVerifier("https://login.microsoftonline.com/foo", keys, cfg)
Describe alternatives you've considered
There are no alternatives to verify the tokens
Additional context
Azure creates well-known config and keys specific to an app as soon as custom apis are defined
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the authentication code that configures remote key retrieval and compare it with the coreos/go-oidc example linked in the issue. Confirm how Azure's appid-specific keys URL is handled, then verify that tokens signed with those keys can be checked successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, typescript
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100