OAuth2 Resource Server Auto-Configuration can only configure a single JWS algorithm #31321

Activity

1. wilkinsona

   added

   type: bugA general bugA general bug

   on Jun 9, 2022
2. wilkinsona

   added this to the 2.7.x milestone on Jun 9, 2022
3. wilkinsona

   self-assigned this

   on Jun 9, 2022
4. wilkinsona commented on Jun 9, 2022

   

   wilkinsona

   on Jun 9, 2022

   Last edited by wilkinsona

   MemberAuthor

   More actions

   The differences between using a JWK Set URI and a public key location present an interesting problem. We configure both using the same jws-algorithm property but only the former can potentially support multiple values when creating the JWT decoder.

   Use of a JWS Set URI or a public key location is mutually exclusive and we'll only ever auto-configure one decoder. This means that we could change both to use the new jws-algorithms property. We'd then have to handle the case where multiple algorithms and a public key location have been configured. I've implemented a proposal for this in this branch. Flagging for team attention as I'd like to see if we're in agreement on this being a good idea…
5. wilkinsona

   added

   for: team-attentionAn issue we'd like other members of the team to reviewAn issue we'd like other members of the team to review

   on Jun 9, 2022
6. mhalbritter commented on Jun 10, 2022

   

   mhalbritter

   on Jun 10, 2022

   Contributor

   More actions

   Your changes look good to me.
7. wilkinsona

   removed

   for: team-attentionAn issue we'd like other members of the team to reviewAn issue we'd like other members of the team to review

   on Jun 16, 2022
8. wilkinsona

   modified the milestones: 2.7.x, 2.7.1 on Jun 16, 2022
9. wilkinsona

   added a commit that references this issue on Jun 16, 2022

   Allow multiple JWS algorithms to be configured

   ...

   This issue will close once commit a1cc5bf is merged into the 'main' branch.

   a1cc5bf
10. wilkinsona

    closed this as completedin a1cc5bfon Jun 16, 2022