Paul Schneider
2c6d11577c
IdentityServer8 was emitting JWTs without a 'kid' header and serving the JWKS without per-key identifiers, because LoadSigningCredentialsInner constructed RsaSecurityKey / ECDsaSecurityKey objects without an explicit KeyId. Resource servers (Yavsc.Blogs, Yavsc.Api) cannot match a token to a key in the JWKS without one, so every signature validation failed with 'The signature key was not found' (Microsoft.IdentityModel IDX10500). Root cause: SigningCredentials were built directly from the BC-parsed key parameters, bypassing the X509Certificate2 path IdentityServer normally derives the kid from. The fix derives a stable KeyId from the certificate's SHA-256 thumbprint (truncated to 16 hex chars) and sets it on both SecurityKey variants before constructing SigningCredentials. The thumbprint-based kid is stable across process restarts as long as the cert doesn't change, and changes naturally on LetsEncrypt renewal (~90 days), which is the right behaviour: old tokens age out, resource servers refresh their JWKS cache to discover the new kid. Production rollout: redeploy Yavsc.Org and re-login (or let the refresh-token path rotate) so newly issued tokens carry the kid. Pre-restart tokens will continue to be rejected with IDX10500 until they expire or are refreshed.
43 lines
858 B
YAML
43 lines
858 B
YAML
opencollection: 1.0.0
|
|
|
|
info:
|
|
name: blogs
|
|
config:
|
|
proxy:
|
|
inherit: true
|
|
config:
|
|
protocol: http
|
|
hostname: ""
|
|
port: ""
|
|
auth:
|
|
username: ""
|
|
password: ""
|
|
bypassProxy: ""
|
|
|
|
request:
|
|
auth:
|
|
type: oauth2
|
|
flow: authorization_code
|
|
authorizationUrl: "{{Authority}}/connect/authorize"
|
|
accessTokenUrl: "{{Authority}}/connect/token"
|
|
refreshTokenUrl: https://yavsc.pschneider.fr/connect/token
|
|
callbackUrl: "{{Authority}}"
|
|
credentials:
|
|
clientId: postit
|
|
placement: basic_auth_header
|
|
scope: openid blogs
|
|
pkce: {}
|
|
tokenConfig:
|
|
id: credentials
|
|
placement:
|
|
header: Bearer
|
|
source: access_token
|
|
settings:
|
|
autoFetchToken: true
|
|
autoRefreshToken: false
|
|
bundled: false
|
|
extensions:
|
|
bruno:
|
|
ignore:
|
|
- node_modules
|
|
- .git
|