fix(oidc settings): effective JWS algorithm setting #9712
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Due to a bug in
OidcConfigs
, thepreferredJwsAlgorithm
setting was never used when OIDC "dynamic" settings are set/enabled. Probably to workaround this bug, a change was made to useauth.oidc.preferredJwsAlgorithm
from the application configuration (same asAUTH_OIDC_PREFERRED_JWS_ALGORITHM
environment variable) if thepreferredJwsAlgorithm
setting was not specified in the OIDC dynamic settings - which is always the case due to the bug. This workaround also prevents us from simply using an existingpreferredJwsAlgorithm
setting as it could differ from an actually used configuration option which might have a different value - causing breakage to existing deployments.This change introduces a new
preferredJwsAlgorithm2
field in the OIDC settings that is actually used if set. The workaround is also partially preserved in that ifpreferredJwsAlgorithm2
is not set, the value fromauth.oidc.preferredJwsAlgorithm
is used. The response from theauth/getSsoSettings
endpoint now returns the value ofpreferredJwsAlgorithm2
but still uses the same field name.Checklist