[
https://issues.apache.org/jira/browse/TOMEE-4029?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richard Zowalla closed TOMEE-4029.
----------------------------------
Fix Version/s: 11.0.0
10.3.0
Resolution: Fixed
Fixed in https://github.com/apache/tomee/commit/f951316a2e (main) and
https://github.com/apache/tomee/commit/5fd2b10bdb (tomee-10.x): with several
JWKS keys, a token without kid is verified against the keys' signatures.
> Use of JWKS forces kid to be present in JWTs
> --------------------------------------------
>
> Key: TOMEE-4029
> URL: https://issues.apache.org/jira/browse/TOMEE-4029
> Project: TomEE
> Issue Type: Bug
> Affects Versions: 9.0.0-M8, 8.0.12
> Reporter: David Blevins
> Priority: Major
> Fix For: 11.0.0, 10.3.0
>
>
> The MicroProfile JWT specification does not mandate that a {{kid}} be present
> in the JWT for JWKS support to work.
>
> The specification explicitly states that *if* a kid is present in the JWT,
> then only that key must be attempted or no key if a matching key does not
> exist. The intent is that if the kid is not present each key should be tried.
>
> This is important for example if a user is currently validating JWTs from
> system A and those JWTs have no kid. If at any point the user needs to also
> accept JWTs from a different system, say system B, another public key would
> need to be configured. The only standard support for multiple public keys is
> via JWKS. However, we may not be able to force system A or B to now suddenly
> include a kid in their produced JWTs. Were this scenario to arise, the
> current code would never result in a positive authentication and the user
> would be stuck with no other choice than to abandon use TomEE's MP-JWT
> implementation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
