Cognito integration about mod_authnz_jwt HOT 9 OPEN

Hello,

The token should be correctly decoded if you transform the public exponent "n" of your jwks into a valid PEM RSA public key. To validate signature, I'm using libjwt (https://github.com/benmcollins/libjwt) using itself openssl.

Can you give me public keys in PEM format used to check validation and a JWT (even expired) delivered by AWS to try to help you more ? You can email me at anthony[at]deroche.me

Regarding the last question, I cannot support JWKS for the moment in my module, although it might be interesting to do so. The underlying library I'm using does not support JWKS itself. I will propose it on the tracker.

from mod_authnz_jwt.

Thanks. I emailed you the requested items. Did you receive them? Thanks.

from mod_authnz_jwt.

Hello, yes I received your email. I will take a look at this and I will keep you posted.

from mod_authnz_jwt.

I reproduced the bug, and it seems to be a bug of the underlying lib I'm using to decode tokens. I opened an issue on the repo of the lib. I will keep you posted as soon as I have more information.

from mod_authnz_jwt.

The bug has been fixed, you should be able to validate tokens using my module using a PEM public key. Be careful to use libjwt v1.7.3, I updated the README with the correct version.

from mod_authnz_jwt.

Thank you. I will put libjwt 1.7.3 into the lab and will update you with the findings.

from mod_authnz_jwt.

I have been able to confirm that if I utilize the correct key that the JWT will validate. However, a Cognito user pool utilizes 1 of 2 keys to sign the JWT. Is there a mechanism that I can utilize to specify both keys as 2 AuthJWTSignaturePublicKeyFile entries in the Apache config, or add both keys to 1 file and have the module iterate over both keys to validate the JWT?

If you require a new JWT, let me know and I can supply that via email. Thanks.

from mod_authnz_jwt.

I hate to be a bother with this, but are you actively working on this or can I have a friend of mine submit a pull request to work on this functionality? Thanks.

from mod_authnz_jwt.

I just saw your messages, I'm not working on this for now, you can submit a pull request!

from mod_authnz_jwt.