Skip to content

Add private key jwt auth - #1241

Merged
CarlSchwan merged 23 commits into
mainfrom
enh/noid/private-key-jwt-auth
Oct 28, 2026
Merged

Add private key jwt auth#1241
CarlSchwan merged 23 commits into
mainfrom
enh/noid/private-key-jwt-auth

Conversation

@julien-nc

@julien-nc julien-nc commented Oct 28, 2025 •
edited by CarlSchwan
Loading

Copy link
Copy Markdown
Member

Implement the "Private key JWT client authentication" flow.

https://auth0.com/docs/fr-ca/authenticate/enterprise-connections/private-key-jwt-client-auth
https://www.keycloak.org/securing-apps/authz-client#_client_authentication_with_signed_jwt
https://docs.developer.singpass.gov.sg/docs

  • Generate key pair for signature
  • Implement refresh mechanism for signature key
  • Implement the client assertion JWT generation to be passed to the IdP on login
  • Generate key pair for encryption (for the provider to potentially generate a JWE returned by the token_endpoint)
  • Implement refresh mechanism for encryption key with key rotation
  • Adjust the code endpoint to detect if we got a JWE or a JWT from the token endpoint, act accordingly
  • Add doc to README
  • New provider-specific setting to toggle this new authentication method
  • Add hints in the settings UI
  • Make it possible to force-enable PCKE even when no code_challenge_methods_supported is found in the discovery endpoint's payload
  • Add a regexp mechanism to extract user IDs from a token attribute
  • double check logic of signature key rotation
  • implement proper encryption key rotation like for the signature ones

@julien-nc julien-nc self-assigned this Oct 28, 2025
@julien-nc julien-nc added enhancement New feature or request feature request labels Oct 28, 2025
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 4 times, most recently from 56cc2a7 to 352567d Compare November 4, 2025 16:20
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 4 times, most recently from 8dc4e0e to 6d08fc0 Compare November 13, 2025 13:46
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 6 times, most recently from 8369165 to 4dd4ac7 Compare November 20, 2025 09:51
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 4 times, most recently from 465d587 to 5e9e3c5 Compare December 1, 2025 11:42
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 3 times, most recently from 343a387 to a7f1707 Compare December 22, 2025 14:50
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 3 times, most recently from 61abd9a to 8131815 Compare December 25, 2025 12:21
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 2 times, most recently from 1b59339 to ebde1bc Compare January 9, 2026 13:44
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch from ebde1bc to 76023aa Compare January 23, 2026 09:37
@CarlSchwan
CarlSchwan force-pushed the enh/noid/private-key-jwt-auth branch 2 times, most recently from 4161ee4 to 5fd663f Compare October 26, 2026 10:59
pringelmann
pringelmann reviewed Oct 27, 2026
View reviewed changes
Comment thread lib/Service/JwkService.php Outdated
julien-nc and others added 23 commits October 27, 2026 13:40
@julien-nc @CarlSchwan
gen ssl key pair and convert the public key to JWK
d55da73 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
store pem priv key in appconfig, gen JWK from public ssl key, test cr…
64fb852 
…eating and decoding JWT from our key

Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
use EC signature key with P-384 curve
bc9d2da 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
generate/store/refresh encryption key
02349c9 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
add new boolean setting to enable private key jwt auth
0032b86 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
implement private jwt login flow by passing the client assertion to t…
a0bce44 
…he token endpoint

Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
adjust README and settings UI
4cea368 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
increase key lifetime to one hour, add comments on when/why we refresh
4693d8e 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
implement small signature key tests
1001185 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
implement small encryption key tests
0a3369d 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
implement JWE encryption + decryption with algos working with singpass
5b4e83b 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
implement JWE tests
d68d176 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
polish
2d72bc3 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
tests
f042e1f 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
last part: detect if a JWT is in a JWE on login
469cd0e 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
handle errors when parsing JWT header at the end of the code flow
ad498d0 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
implement encryption key rotation for JWE decryption
2f20393 
Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
do not log sensitive data, fix user_id regexp logic, only decrypt cli…
d17d2e9 
…ent secret if needed

Signed-off-by: Julien Veyssier <[email protected]>
@julien-nc @CarlSchwan
[WARNING] needs logic check: improve signature key rotation
490343c 
Signed-off-by: Julien Veyssier <[email protected]>
@CarlSchwan
fix(login): decrypt JWE id tokens which also have typ=JWT
4cc443f 
Signed-off-by: Carl Schwan <[email protected]>
@CarlSchwan
feat(crypo): implement proper encryption key rotation
5cd75ce 
Make the code for signature key roation generic and use it for
encryption too.

Signed-off-by: Carl Schwan <[email protected]>
@CarlSchwan
fix: Vendor new dependencies
81a5d80 
And update mozart to fix some issues with the vendoring

Signed-off-by: Carl Schwan <[email protected]>
@CarlSchwan
fix(crypto): store private keys as sensitive app config values
1857d7f 
Signed-off-by: Carl Schwan <[email protected]>
@CarlSchwan
CarlSchwan force-pushed the enh/noid/private-key-jwt-auth branch from 5fd663f to 1857d7f Compare October 27, 2026 13:04
@CarlSchwan
CarlSchwan merged commit 4408c27 into main Oct 28, 2026
77 of 78 checks passed
@CarlSchwan
CarlSchwan deleted the enh/noid/private-key-jwt-auth branch October 28, 2026 07:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@CarlSchwan CarlSchwan CarlSchwan left review comments
@pringelmann pringelmann pringelmann approved these changes
@juliusknorr juliusknorr Awaiting requested review from juliusknorr juliusknorr is a code owner

Assignees

@julien-nc julien-nc

Labels

enhancement New feature or request feature request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@julien-nc @pringelmann @CarlSchwan