JWK Error

[agkoutis]

Hello all,

I have notice wile I'm trying to perform logout from a client app, I'm getting validation error in CheckSessionController / ExtractIdTokenHint > "no JWK with identifier rsa-1 has been found to check the signature of the JWT"

The same error occurs while I'm trying to generate a new cert using the Admin UI.

Do you know where I need to start fixing this error?

Thanks !
Aggelos

[simpleidserver]

Hello :)

Firstly, are you using the 'master' branch? If not, could you try using this branch? We have addressed some issues related to the logout functionality (Ticket #674, Ticket #648).

Could you also check the https://localhost:5001/master/jwks endpoint to see if there is a key with the identifier 'rsa-1'?

[agkoutis]

Hey, we are currently @ V 4.0.5 , we have some code to merge to migrate to 4.0.6. We are planning to do an upgrade in the near feature.

About the JWK here is the response (we are not using the realms functionality)

https://localhost:5001/jwks :

{"keys":[{"alg":"ES256","crv":"P-256","kid":"ecdsa-1","kty":"EC","use":"sig","x":"RUAcjzCA9dTuwW0kY7QorwCd_3hoS1SJLEhFCF2IlS8","y":"REnbgA3RXBrDPZZi5CaOq4XF4QrlJWoXQ8Qc-vCsJlI"},{"alg":"RS256","e":"AQAB","kid":"rsa-1","kty":"RSA","n":"yNTR32MLILuDyz8Ijt8dI-9Y0hzbVaZaG3I_yDEuZ6Vnr8WEREKnn_eJfNBVHGcSzeD5PqS5bwI_iZ7Re_g0AaQXJHroQjJmKrkqo3V_v2kUzo9p6f0Eni2HwPBydpLd38GG9xha5QCZXTraGflNjl2MpXSfMaxGnTRaUydjh-1yjT9KvLS_nlQgHz02shgJXuhxCnykV2vZsOljMOYvEZtEcndPCOSgacimfhkbrufNRPjoqPOd6ZxZYNKVJClN-dY_ur2TjeD4DCv6ud2K_N7_4syI8vVTDcr-BbnK61qIQs2zEubB5qANXUdBwYAjq3hTuwYXSF9hSRKdYwHdbQ","use":"sig"},{"alg":"RS256","e":"AQAB","kid":"wsFedKid","kty":"RSA","n":"0R_G_hQWOymmWI8lm6E7iEWNDaciCVo9V6HXrpa6LO_CIleHpLlHIsDVn0BG5GbedqSqvSOqcerNZC9ZGc8HbSMWhk0nOseC2T78nr_g9elPTAQN0x6gPhEmvz69QR8P2-zjv8JinIfHf6fagvrudEYisgj_RwogQ9QrQ0gLHh-5gFCVj7KaN467JAk1TzN5OSdpWBh3Te5Jk4rzq1WF9KXGv_2Fh9JdXnyiwalGEAtXBUtH3LM7zSqSiYm6wfd4ra9fI6TivU6PQXaGtermFdZeKwFKNOKwDTH3Ctnv5wNcsuXqBZSeVBqC0nTM7grnrW40rJQVHynVp5K_UWnYCQ","use":"sig","x5c":["MIIC2jCCAcKgAwIBAgIIThm0kQMYVPowDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAxMYU2VsZi1TaWduZWQtQ2VydC1FeGFtcGxlMB4XDTIzMTAwOTE0MzA0NloXDTMzMTAxMDE0MzA0NlowIzEhMB8GA1UEAxMYU2VsZi1TaWduZWQtQ2VydC1FeGFtcGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0R/G/hQWOymmWI8lm6E7iEWNDaciCVo9V6HXrpa6LO/CIleHpLlHIsDVn0BG5GbedqSqvSOqcerNZC9ZGc8HbSMWhk0nOseC2T78nr/g9elPTAQN0x6gPhEmvz69QR8P2+zjv8JinIfHf6fagvrudEYisgj/RwogQ9QrQ0gLHh+5gFCVj7KaN467JAk1TzN5OSdpWBh3Te5Jk4rzq1WF9KXGv/2Fh9JdXnyiwalGEAtXBUtH3LM7zSqSiYm6wfd4ra9fI6TivU6PQXaGtermFdZeKwFKNOKwDTH3Ctnv5wNcsuXqBZSeVBqC0nTM7grnrW40rJQVHynVp5K/UWnYCQIDAQABoxIwEDAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggEBAEJucvK4b1X4mw9WkxzvezZDx/M59VLpx2VSSO4Ezn+pXxAXm1wji7G2bUwPDg9RT+abHZgFg1IZXqg7XgiQzHyY9YBRApt3RQHdioaUnF/GB0QG3Ol2eafEyBb1nWmIKOnS9zOfpOfNuRfFtMsaWsfpqYuk2CzoxccFD7ZJDL/T1WA8tjydu2ejvrXr+J7LYOuWecw4w6zc0KjkbYFs4LqnbwPrE93Xc3wLOGLPHa/Jl1twtOKfMjIy3P03VlW4IemYmyYFh2eJwXNLnL1NyvMO+kR5/Ezd/z3RDNpK3jL1qZWDp+V/RN4H9pNzTFKFbwbZA9H3VRtuqrqOcBQQLtA="],"x5t":"jSBhh-Z0LY4xg8X0i_RsoUQc8c0"}]}

Thanks!

[simpleidserver]

The exception is triggered when the realm is set to NULL; the value must be set to "master," or else the Json Web Key cannot be located. This problem has been resolved in release 4.0.6.

For more details, refer to the following link: 88a63c5#diff-92355e53a3aa4b88d7da895765ca8190ab4f34229d25153caf799eb1580faf5eR143

[agkoutis]

Hello,

I have already started the migration process but have problems registering the SID site OIDC.

In V4.0.5 there was a AddOIDCAuthentication but I can no longer find it.

https://github.com/simpleidserver/SimpleIdServer/blob/release/4.0.5/src/IdServer/SimpleIdServer.IdServer.Startup/Program.cs

a.AddOIDCAuthentication(opts =>
{
opts.Authority = identityServerConfiguration.Authority;
opts.ClientId = "website";
opts.ClientSecret = "password";
opts.ResponseType = "code";
opts.ResponseMode = "query";
opts.SaveTokens = true;
opts.GetClaimsFromUserInfoEndpoint = true;
opts.RequireHttpsMetadata = false;
opts.TokenValidationParameters = new TokenValidationParameters
{
NameClaimType = "name"
};
opts.Scope.Add("profile");
});

Right now I'm getting this error :

private SIDAuthenticationScheme Convert(Domains.AuthenticationSchemeProvider provider)
{
lock(_lck)
{
var handlerType = Type.GetType(provider.AuthSchemeProviderDefinition.HandlerFullQualifiedName);
var authenticationHandlerType = GetGenericType(handlerType, typeof(AuthenticationHandler<>));

Any ideas?

Thanks for the help!

[simpleidserver]

Since version 4.0.6, the Identity Server Service (https://localhost:5001) no longer utilizes the OPENID authentication protocol, and the code AddOIDCAuthentication has been removed.

You encountered this exception because the DynamicAuthenticationSchemeProvider is unable to resolve the Authentication Handler.
This is likely due to an incorrect HandlerFullQualifiedName.
Could you please verify if the fully qualified name is accurate and update the value accordingly?

[agkoutis]

I think everything is fine here, records already exists

Thanks for the help!

[agkoutis]

It seems that the problem was with Nuget packages on csproj, we don't use facebook or google and this wasn't a strong dependency in 4.0.5.

PackageReference Include="Microsoft.AspNetCore.Authentication.Facebook" Version="7.0.1"
PackageReference Include="Microsoft.AspNetCore.Authentication.Google" Version="7.0.1"

Thanks for the help!

[agkoutis]

Hello, im to returning to this after upgrading to 4.0.6 I'm still getting the same error, even I'm when I'm trying to generate a new cert from admin.

In the following code, I'm trying to sign out from client app. First EndSession endpoint is called => ExtractIdTokenHint => ReadSelfIssuedJsonWebToken.

sigKey & realm is null and I'm getting an exception.
Am I missing something?

[simpleidserver]

Hello,

I attempted to replicate the issue on my local machine using version 4.0.6, but was unsuccessful. I performed the following operations:

1. Ran the identity server and identity server website.
2. Browsed the website and authenticated with the administration account.
3. Signed out from the administration website. I successfully signed out from the website, and no exceptions were thrown.

Could you please provide the precise steps to reproduce this problem?

[agkoutis]

Hello,

I believe is the same error with two different causing cases.

We have disabled realm by setting useRealm = false;

1st Case

An MVC is trying to Single Sign Out using OIDC middleware.
The EndSession endpoint is called with id_token_hint and redirection URL. (Note please that when the simple EndSession is called everything works fine).

When the process of EndSession endpoint reaches ReadSelfIssuedJsonWebToken I'm getting this error. (sigKey & realm parameters are null)

Id_token_hint =>

eyJhbGciOiJSUzI1NiIsImtpZCI6InJzYS0xIiwidHlwIjoiSldUIn0.eyJhdWQiOlsiQ3ViZVJNQ2xvdWQiLCJodHRwczovL2xvY2FsaG9zdDo3MDM0Il0sImF6cCI6IkN1YmVSTUNsb3VkIiwiYXRfaGFzaCI6ImxnUHZBa0V3QVVqdWt4N0pQVndLTkEiLCJub25jZSI6IjYzODQ0MTE3MzM5OTg2NzIwNS5ZMk15Tnpaa04ySXRNV0ZtWVMwME9ERmtMVGxpWVRNdE0ySXlOamN3TkdVeU5UVTFZek14TnpBek16QXRaV1UyTlMwMFl6Y3dMVGd5WkdFdE1EZ3dOR00yTWpJeE9XWTIiLCJhbXIiOlsicHdkIl0sImFjciI6InNpZC1sb2FkLTAxIiwic2lkIjoiN2E5ZDZiZDEtMDc0Yy00ZWI4LWEwYTEtYTA2ZWY5NGYzZjFlIiwic3ViIjoiNTY3MWMyMjItNDEwMS00MWVmLWI5ODEtMTY2ZWY4OTY2ZGFiIiwiZXhwIjoxNzA4NTI3NzY5LCJpc3MiOiJodHRwczovL2xvY2FsaG9zdDo3MDM0IiwiaWF0IjoxNzA4NTIwNTY5LCJuYmYiOjE3MDg1MjA1Njl9.Ym5I0QHS9C-Tr17ef4h11iZBstRN_6ulLDJiY2sIc94NolqEv8BQ6HQnGL0uqQOgIGjZ39zFeyFC1R308SEbq8TBtRb_5gjC99o09A040RnwkKKyGFPdfHB_TMgzc4lDzlgzol-qIUYTxbueVLRbncj8zhmjNywDmN8sBhcF95pEvzDdLKU_LO8TgWIA9tghvYKn1SI34acVrBclg1uxQQutyXcsXAgfW_dSiJ4mQ9YeWsY3EHduT3iz1DAbTk_N3UBcWFiSOHt6Jhi1-8rjrlHr5H7JfsgGSLYRXX81KsO5z1Lc64S6AFx3Dp64QefSWnJNZj03ooVXbF9Ups_jYQ

2st Case

Form the AdminUI im trying to generate a new cetrificate (again we have disabled the useRealm)

Ty!

[simpleidserver]

Hello,

There were indeed two issues: one in the CheckSessionController and another one in the CertificateAuthoritiesController. It was not possible to fetch the JWKS because the realm was set to NULL; however, by default, it must always be set to master. The changes have already been implemented in the master branch.

If you wish, we can release version 4.0.8-rc1 of the SimpleIdServer Nuget package, incorporating these fixes. Additionally, since version 4.0.7, other issues related to user session management have also been addressed. Ticket #648 provides a comprehensive list of these fixes.

[agkoutis]

Hello, thanks no need for 4.0.8-rc1 Nuget package.