[java-idp-plugin-oidc-op-oidfed] branch main updated: Filter out JWKs that defines a non-matching algorithm.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.

View the commit online:
https://git.shibboleth.net/view/?p=java-idp-plugin-oidc-op-oidfed.git;a=commit;h=f22211136176a4504982c1c93f6345726a1ab206

The following commit(s) were added to refs/heads/main by this push:
     new f222111  Filter out JWKs that defines a non-matching algorithm.
f222111 is described below

commit f22211136176a4504982c1c93f6345726a1ab206
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Nov 4 18:29:27 2025 +0200

    Filter out JWKs that defines a non-matching algorithm.
    
    Otherwise the non-matching credentials cause confusing WARN-logs in the trust engine.
---
 .../op/oidfed/metadata/DefaultPayloadJOSEObjectCredentialResolver.java  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultPayloadJOSEObjectCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultPayloadJOSEObjectCredentialResolver.java
index 895728f..cba6fd1 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultPayloadJOSEObjectCredentialResolver.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultPayloadJOSEObjectCredentialResolver.java
@@ -66,6 +66,8 @@ public class DefaultPayloadJOSEObjectCredentialResolver extends BasicJOSEObjectC
             final JWKSet jwks = JWKSet.parse(rawJwks);
             return jwks.getKeys().stream()
                     .filter(Objects::nonNull)
+                    .filter(jwk -> jwk.getAlgorithm() != null ? 
+                            jwk.getAlgorithm().equals(jwt.getHeader().getAlgorithm()) : true)
                     .map(jwk -> buildJWKCredential(jwk, null))
                     .filter(Objects::nonNull)
                     .map(Credential.class::cast)

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.