The authenticator refuses to validate signed id tokens which are not using RS256 algorithm

View issue · Add comment

Issue created

Thomas Mortagne created this issue on 05/Jun/25 12:22

Summary:	The authenticator refuses to validate signed id tokens which are not using RS256 algorithm
Issue Type:	Bug
Affects Versions:	2.18.0
Assignee:	Unassigned
Components:	Authenticator
Created:	05/Jun/25 12:22
Priority:	Major
Reporter:	Thomas Mortagne
Description:	The ID validator behavior is a bit strange: it's mandatory to indicate it when creating the validator, while it could easily use the one indicated in the JWT when calling validate().

1 update

Changes by Thomas Mortagne on 05/Jun/25 12:24

Description:

The ID validator behavior is a bit strange: it's mandatory to indicate it when creating the validator, while it could easily use the one indicated in the JWT when calling validate(). So the code was setting one, expecting it more to be the default, but turns out it's the only accepted one, and it's not possible to configure the validator to accept any supported algorithm.

This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)

If image attachments aren't displayed, see this article.