Describe the Bug
Microsoft can provide the following format at its jwks_uri:
{
"kty": "RSA",
"use": "sig",
"kid": "abcabcabc",
"x5t": "abcabcabc",
"n": "xxxxyyyyyzzzz",
"e": "AQAB",
"x5c": [
"aaaabbbbcccc"
],
"issuer": "https://login.microsoftonline.com/xxx-xxx-xxx/v2.0"
}We have the following logic to filter keys to the compatible ones:
|
return array_filter($keys, function (array $key) { |
|
return $key['kty'] === 'RSA' && $key['use'] === 'sig' && $key['alg'] === 'RS256'; |
|
}); |
This fails due to the alg property being non-existent.
Couple of things we need to do:
- Check MS provided keys against the standard, support their format if we can identity.
- Update our filtering to not hard fail on potentially non-assured properties (Relevant to the spec)
Describe the Bug
Microsoft can provide the following format at its jwks_uri:
{ "kty": "RSA", "use": "sig", "kid": "abcabcabc", "x5t": "abcabcabc", "n": "xxxxyyyyyzzzz", "e": "AQAB", "x5c": [ "aaaabbbbcccc" ], "issuer": "https://login.microsoftonline.com/xxx-xxx-xxx/v2.0" }We have the following logic to filter keys to the compatible ones:
BookStack/app/Auth/Access/Oidc/OidcProviderSettings.php
Lines 166 to 168 in 6e325de
This fails due to the
algproperty being non-existent.Couple of things we need to do: