Repository navigation
Align with a production identity provider - #4
Merged
Merged
Conversation
…yped client assertions The worker validated only ES256 access tokens; a production issuer (e.g. OpenIddict) signs RS256. Accept both RS256 and ES256 — both asymmetric, with the key type matched to the algorithm, so no algorithm-confusion risk — while HMAC and unsigned tokens stay refused. Client assertions now carry the header typ=client-authentication+jwt (RFC 8725 explicit typing), which such issuers require, and the development BasicIdentityProvider now requires that typ too so it matches. The identity-provider contract doc is updated accordingly (RS256 or ES256, RSA or EC JWKS, the assertion typ).
The worker-configuration table-section text still said the worker accepts ES256 tokens only; it accepts RS256 and ES256. Align the wording with the validation change.
SignalR hands claims to the worker as HTTP headers; a line break there broke the connection of every client listing two or more peers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The worker now accepts RS256 next to ES256 tokens, and the client types its assertion
client-authentication+jwt. A production identity provider (OpenIddict) requires both. Tested end to end against the dbosoft staging identity provider with org-scoped clients.That test also found a bug: the worker's SignalR claim separated peers with a line break. SignalR passes claims to the worker as HTTP headers, so every client listing two or more peers failed to connect. Peers are now separated by
/.Clients from older packages send untyped assertions, which the identity provider refuses, so they need the new client package.