[JIRA] (JOIDC-59) kid missing from id_token header after upgrading from extension

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *commented* on JOIDC-59 ( https://shibboleth.atlassian.net/browse/JOIDC-59?atlOrigin=eyJpIjoiZDYwY2Q2NzE0YjM2NDEyMWE0NjJhODczMTA2N2MxNGMiLCJwIjoiaiJ9 )

Re: kid missing from id_token header after upgrading from extension ( https://shibboleth.atlassian.net/browse/JOIDC-59?atlOrigin=eyJpIjoiZDYwY2Q2NzE0YjM2NDEyMWE0NjJhODczMTA2N2MxNGMiLCJwIjoiaiJ9 )

I was not able to reproduce your issue via any JWK credentials that contain kid-claim (like your idp-signing-rs.jwk does).

Have you modified the oidc-credentials.xml file from the version that is provided in the distribution? It’s the one that should be imported by your credentials.xml. Can you double-check the contents *shibboleth.oidc.SigningCredentials* -bean/list? It should contain references to shibboleth.oidc.Default* credentials, which are JWK credentials by default.

One way to reproduce id_tokens without kid is to use PEM credentials (e.g. shibboleth.DefaultSigningCredential) for OIDC signing without defining any names for them via *p:keyNames* parameter.

Also the PEM credentials can be used, but in that case the name should be defined in the following way:

   <bean id="shibboleth.oidc.DefaultRSSigningCredential"
       class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
       p:privateKeyResource="key-file"
       p:certificateResource="cert-file"
       p:keyNames="KID_HERE" />

( https://shibboleth.atlassian.net/browse/JOIDC-59#add-comment?atlOrigin=eyJpIjoiZDYwY2Q2NzE0YjM2NDEyMWE0NjJhODczMTA2N2MxNGMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-59#add-comment?atlOrigin=eyJpIjoiZDYwY2Q2NzE0YjM2NDEyMWE0NjJhODczMTA2N2MxNGMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:ce8a569 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211101/066bdd60/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-976b584c-7a9f-4031-99b5-3bba4d488f7f
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211101/066bdd60/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-b29af634-2e31-40b7-b0a5-65ef2af94ec6
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211101/066bdd60/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-16b16b32-b514-4d62-9c70-5fe86b6803f6
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211101/066bdd60/attachment-0005.png>