Skip to content

feat(jans-cedarling): improve error handling for JWKS responses #9966

@rmarinn

Description

@rmarinn

Is your feature request related to a problem? Please describe.

Currently, when a jwks_uri returns multiple keys with varying algorithm support, Cedarling stops initialization if any key is associated with an unsupported algorithm. This behavior can lead to unnecessary disruptions in the service.

Describe the solution you'd like

Enhance the error handling mechanism so that Cedarling does not halt initialization when encountering a key from the JWKS with an unsupported algorithm. This improvement will allow for smoother operation and better handling of dynamic key sets.

Describe alternatives you've considered

  • Using Other Libraries: Other libraries are pretty much lacking compared to the jsonwebtoken create which is probably why the jsonwebtoken crate has the most recent downloads.
  • Forking the jsonwebtoken Crate and implementing the unsupported algorithm: Modifying the jsonwebtoken crate itself is an option, but it would create maintenance challenges... it's probably better to just wait for an update for now until we really need it.

Additional context

The following algorithms are supported in the test-case server:

  • RS256
  • RS384
  • RS512
  • ES256
  • ES384
  • ES512 (not supported in the jsonwebtoken crate)
  • PS256
  • PS384
  • PS512
  • RSA1_5,
  • RSA-OAEP
  • RS256

The following algorithms are supported by the jsonwebtoken crate:

  • HS256
  • HS384
  • HS512
  • ES256
  • ES384
  • RS256
  • RS384
  • RS512
  • PS256
  • PS384
  • PS512
  • EdDSA
  • RSA1_5
  • RSA-OAEP
  • RSA-OAEP-256

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions