Problem/Motivation

Forked off from #3033472: [PP-1] Support OpenID Connect Discovery, this intends to implement RFC 7517 JWKs for either standalone use or in conjunction with OpenID Connect discovery (the original ticket.)

Remaining tasks

Implementation and testing.

Since we already outsource most of the under-the-hood crypto operations to league/oauth2-server, and it in turn requires lcobucci/jwt, it would make the most sense to assist with completing JWK implementation in the latter library (an issue is open for 5+ years - but still active - to do this!) It may be possible to lift the code from web-token/jwt-framework to do this, since it is MIT-licensed and looks rather mature. (Probably a bit impractical though to suggest swapping JWT libraries.

Another approach could be requiring web-token/jwt-framework directly and if JWKs support ever lands in league or its dependencies, we pull out the additional library from our dependencies.

I (@bradjones1) am leaning toward trying to contrib this in to lcobucci/jwt, seeing as JWK is on its roadmap and the maintainer is actively involved/this is supporting the software we are already using.

User interface changes

None.

API changes

Additions but no removals.

Data model changes

None.

Issue fork simple_oauth-3174705

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

bradjones1 created an issue. See original summary.

bradjones1’s picture

bradjones1
Primary language English
commented
Issue summary: View changes
bradjones1’s picture

bradjones1
Primary language English
commented

Related upstream issues/comments:

https://github.com/thephpleague/oauth2-server/issues/1142 (Proposing a potential change of underlying library in the League package)
https://github.com/thephpleague/oauth2-server/issues/1007#issuecomment-5... (re: JWKs for key loading)
https://github.com/lcobucci/jwt/issues/32 (JWK support in existing dependency)

e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
commented

👏

matt_paz’s picture

matt_paz commented

@bradjones1 - It looks like lcobucci/jwt is targeting this for the 5.0.0 release.

https://github.com/lcobucci/jwt/milestone/8

Not sure what a forecast looks like for the 5.0.0 release, but if it is is projected to be quite some time (given the 4.0.0 hasn't been released yet), it might make sense to consider alternatives/stop gap measures you mentioned. I haven't delved deeply here yet, but figured I'd throw it out there.

I see now that it has been updated for a 4.0.1 release with php 7.4 as a requirement.
https://github.com/lcobucci/jwt/issues/32#issuecomment-719995242

matt_paz’s picture

matt_paz commented

@bradjones1 - I haven't assessed it yet, but I noticed that @kamalw was exploring jumbojett/OpenID-Connect-PHP. Thought it might be worth passing along...

https://www.drupal.org/project/simple_oauth/issues/3182418

bradjones1’s picture

bradjones1
Primary language English
commented

Note to self, there is a JWKS route added as part of #2999521: Add support for Open Id connect but it is not useful as an endpoint to consult for verifying issued tokens.

bradjones1’s picture

bradjones1
Primary language English
commented
Title: Implement JWKs (RFC 7517) » Implement JWKs (RFC 7517) and OAuth metadata (RFC 8414)

We should also implement RFC 8414. See #3182418: Shouldn't the /oauth/jwks endpoint be accessible without authentication?.

bradjones1’s picture

bradjones1
Primary language English
commented
Issue tags: +Spec Compliance
bradjones1’s picture

bradjones1
Primary language English
commented
Version: 5.x-dev » 5.2.x-dev
sanduhrs’s picture

sanduhrs
he/him
Primary language German
Location 🇪🇺 Heidelberg, Germany, Europe
commented
Version: 5.2.x-dev » 6.0.x-dev

sanduhrs opened merge request !67

sanduhrs’s picture

sanduhrs
he/him
Primary language German
Location 🇪🇺 Heidelberg, Germany, Europe
commented
Status: Active » Needs work

Pushed the patch from #3182418: Shouldn't the /oauth/jwks endpoint be accessible without authentication? not verifying specs compliance, yet.

nate covington’s picture

nate covington commented

I'm in the process of trying to use Drupal + Simple_Oauth as the single sign on server for Synapse / Matrix.

When I set up the configuration for OpenID Connect in Synapse homeserver.yaml file, it was getting a 403 forbidden error when it tried to connect to the /oauth/jwks endpoint.

Just to document my solution I retrieved my public.key value from Simple_Oauth module

Then I used this this converter tool:
https://russelldavies.github.io/jwk-creator/

And created /.well-known/jwks file by hand

That allowed Synapse to start up with the homeserver.yaml settings intact - yay!

However, when I tried to use app.element.io to log in using Drupal, Synapse was giving this "not canonical" error:

2023-01-26 17:36:53,521 - synapse.rest.client.login - 621 - INFO - GET-80 - Requested URI https://matrix.covingtoncreations.net/_matrix/client/r0/login/sso/redirect/oidc-drupal?redirectUrl=https%3A%2F%2Fapp.element.io%2F is not canonical: redirecting to https://covingtoncreations.net/_matrix/client/r0/login/sso/redirect/oidc-drupal?redirectUrl=https%3A%2F%2Fapp.element.io%2F
2023-01-26 17:36:53,522 - synapse.access.http.8008 - 460 - INFO - GET-80 - 10.0.0.1 - 8008 - {None} Processed request: 0.002sec/-0.001sec (0.000sec, 0.000sec) (0.000sec/0.000sec/0) 0B 302 "GET /_matrix/client/r0/login/sso/redirect/oidc-drupal?redirectUrl=https%3A%2F%2Fapp.element.io%2F HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0" [0 dbevts]

It's trying to get back to matrix.example.com but for some reason it's passing it over to example.com, the matrix server isn't able to actually process the remainder.

idebr’s picture

idebr commented
Status: Needs work » Closed (duplicate)
Related issues: +#3552234: Make JWKS endpoint publicly accessible and add /.well-known/jwks.json alias

This was fixed in #3552234: Make JWKS endpoint publicly accessible and add /.well-known/jwks.json alias

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.