From a2305c3a7cc258c77fd924c4be4ab91802fbe9a3 Mon Sep 17 00:00:00 2001 From: Ragavendaran Puliyadi Date: Tue, 21 Jan 2025 03:44:07 +0530 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20fix:=20use=20OpenID=20token=20si?= =?UTF-8?q?gnature=20algo=20as=20discovered=20from=20the=20server=20(#5348?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * 🐛 fix: use OpenID token signature algo as discovered from the server. * 📜 refactor: Keeping other props that uses alg. * 🔧 fix: handle missing property * 📘 refactor: add comment block --- api/strategies/openidStrategy.js | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/api/strategies/openidStrategy.js b/api/strategies/openidStrategy.js index c12b088bce..33ac6c2716 100644 --- a/api/strategies/openidStrategy.js +++ b/api/strategies/openidStrategy.js @@ -114,10 +114,21 @@ async function setupOpenId() { logger.info(`[openidStrategy] proxy agent added: ${process.env.PROXY}`); } const issuer = await Issuer.discover(process.env.OPENID_ISSUER); + /* Supported Algorithms, openid-client v5 doesn't set it automatically as discovered from server. + - id_token_signed_response_alg // defaults to 'RS256' + - request_object_signing_alg // defaults to 'RS256' + - userinfo_signed_response_alg // not in v5 + - introspection_signed_response_alg // not in v5 + - authorization_signed_response_alg // not in v5 + */ + const supported_alg = { + id_token_signed_response_alg: issuer.id_token_signing_alg_values_supported?.[0] || 'RS256', + }; const client = new issuer.Client({ client_id: process.env.OPENID_CLIENT_ID, client_secret: process.env.OPENID_CLIENT_SECRET, redirect_uris: [process.env.DOMAIN_SERVER + process.env.OPENID_CALLBACK_URL], + ...supported_alg, }); const requiredRole = process.env.OPENID_REQUIRED_ROLE; const requiredRoleParameterPath = process.env.OPENID_REQUIRED_ROLE_PARAMETER_PATH;