ClientAssertion using ES256 algo failed to be validated #12809

kluangguy1 · 2022-06-29T09:05:49Z

kluangguy1
Jun 29, 2022

Dear all,
I am integrating with an Identityprovider via OpenID Connect v1.0 protocol and I am using keycloak v18.0.0. I have configured the following

Identity provider
Client Authentication: JWT Signed with private key
Client Assertion Signature Algorithm: ES256

Realms setting
Provider: ecdsa-generated with Elliptic Curve P-256

When keycloak invoking the Identity Provider token endpoint API, it failed the client assertion validation. According to them, they expect the length of the signature to be 64 instead of 71.

i have attached the sample assertion and jwk public key for reference
clientAssertion.txt
jwkPublicKey.txt

I also test validating the client assertion via the jwt.io website, and it did mention the signature is invalid. Is it something I can configure the "Identity Provider" such that the length signature can be exactly 64?

Thanks for your help
Kluangguy

I have traced the code and it is using the AsymmetricSignatureSignerContext for generating the signature

public byte[] sign(byte[] data) throws SignatureException {
        try {
            Signature signature = Signature.getInstance(JavaAlgorithm.getJavaAlgorithm(key.getAlgorithmOrDefault()));
            signature.initSign((PrivateKey) key.getPrivateKey());
            signature.update(data);
  
            
            return signature.sign();
        } catch (Exception e) {
            throw new SignatureException("Signing failed", e);
        }
    }

Answered by kluangguy1

Aug 30, 2022

To update, I have created customized SPI to override the method "getSignatureContext()" of "AbstractOAuth2IdentityProvider" to make "ECDSASignatureProvider" as provider based on the configuration (private key jwt & choosen clientAssertion algo "ES256, ES384, ES512)", and it solved the issue i encoutered

View full answer

kluangguy1 · 2022-08-30T03:41:54Z

kluangguy1
Aug 30, 2022
Author

To update, I have created customized SPI to override the method "getSignatureContext()" of "AbstractOAuth2IdentityProvider" to make "ECDSASignatureProvider" as provider based on the configuration (private key jwt & choosen clientAssertion algo "ES256, ES384, ES512)", and it solved the issue i encoutered

0 replies

Navigation Menu

Repository navigation

ClientAssertion using ES256 algo failed to be validated #12809

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

ClientAssertion using ES256 algo failed to be validated #12809

Uh oh!

Uh oh!

kluangguy1 Jun 29, 2022

Replies: 1 comment

Uh oh!

Uh oh!

kluangguy1 Aug 30, 2022 Author

kluangguy1
Jun 29, 2022

kluangguy1
Aug 30, 2022
Author