[JIRA] (JOIDC-114) Single broken key in JwksData (SAML metadata) makes whole keyset invalid

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiNWI3MmMzNDdlNjk3NDg2NTkyYTY3MDM5NjEyNTg1NjkiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/JOIDC-114?atlOrigin=eyJpIjoiNWI3MmMzNDdlNjk3NDg2NTkyYTY3MDM5NjEyNTg1NjkiLCJwIjoiaiJ9 ) JOIDC-114 ( https://shibboleth.atlassian.net/browse/JOIDC-114?atlOrigin=eyJpIjoiNWI3MmMzNDdlNjk3NDg2NTkyYTY3MDM5NjEyNTg1NjkiLCJwIjoiaiJ9 ) Single broken key in JwksData (SAML metadata) makes whole keyset invalid ( https://shibboleth.atlassian.net/browse/JOIDC-114?atlOrigin=eyJpIjoiNWI3MmMzNDdlNjk3NDg2NTkyYTY3MDM5NjEyNTg1NjkiLCJwIjoiaiJ9 )

Issue Type: Improvement Affects Versions: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0, 3.1.1, 3.1.2 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Components: Security Created: 23/Jun/22 7:32 AM Priority: Trivial Reporter: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd )

The JwksData in KeyDescriptor may contain a single JWK or a JWKSet. If latter, a single invalid key (for instance missing mandatory attribute) makes the whole set invalid, without producing any informative warning to the logs.

Ideally the valid keys should probably be included to the set in these cases, but in any case the logging should be improved.

( https://shibboleth.atlassian.net/browse/JOIDC-114#add-comment?atlOrigin=eyJpIjoiNWI3MmMzNDdlNjk3NDg2NTkyYTY3MDM5NjEyNTg1NjkiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-114#add-comment?atlOrigin=eyJpIjoiNWI3MmMzNDdlNjk3NDg2NTkyYTY3MDM5NjEyNTg1NjkiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100201- sha1:5c1db44 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220623/1edf4a0e/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-aa114870-d3eb-405f-ad6d-4f6dd5562a9f
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220623/1edf4a0e/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-d184b0e3-b815-4426-8436-5657bb220c98
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220623/1edf4a0e/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-e4fbbdb7-5083-45f1-b8c3-6a95411d7082
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220623/1edf4a0e/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-bbf9b9c6-4380-4e41-8c84-29489f2a9f28
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220623/1edf4a0e/attachment-0007.png>