github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-08-23 21:16:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(openid/config): require and expose the client JWK algorithm

Browse Source 
Both the assertion signer and the provider validation derived the algorithm
from the key and had to handle a missing "alg" that NewClientConfig already
rejects. Validate it once at construction and keep the result.
This commit is contained in:
Trong Huu Nguyen
2026-08-10 12:32:04 +02:00
parent f3f76fccc8
commit 2c708d554c
6 changed files with 91 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration.md
+1 -1
View File
@@ -34,7 +34,7 @@ The following flags are available:
| `openid.acr-values` | string | | Space separated string that configures the default security level (`acr_values`) parameter for authorization requests. |
| `openid.audiences` | strings | | List of additional trusted audiences (other than the client_id) for OpenID Connect id_token validation. |
| `openid.client-id` | string | | Client ID for the OpenID client. |
| `openid.client-jwk` | string | | JWK containing the private key for the OpenID client in string format. If configured, this takes precedence over `openid.client-secret`. |
| `openid.client-jwk` | string | | JWK containing the private key for the OpenID client in string format. Must declare the `alg` header. If configured, this takes precedence over `openid.client-secret`. |
| `openid.client-secret` | string | | Client secret for the OpenID client. Overridden by `openid.client-jwk`, if configured. |
| `openid.domain-hint` | string | | Domain hint to include in authorization request for IdPs that support this parameter (e.g. Entra ID). |
| `openid.jwks-fallback-alg` | string | `RS256` | JWA value (as defined in RFC 7518) to assign to provider JWKS keys when their `alg` header is not set. |