Security Level: Public Data (This ticket is visible to anyone on the internet and will be indexed by search engines)
Right now, the OIDC token validation flow is adapted for WLCG tokens.
The public key is retrieved using the kid hint from the JWT header.
According to the specification, however, the kid field is optional:
Furthermore, the following sections describe methods of key selection:
For FTS, the following algorithm is proposed:
- Retrieve and cache all keys from the JWK endpoint
- Filter the keys against the optional kid header field
- Filter the keys against the optional alg header field
- For each key from the remaining set:
- If key successfully decodes the token, stop the process and return valid
- If not, continue to the next key
- Return invalid if no key decodes the token
- is related to
FTS-1436 _validate_token_offline hardcodes 'rsa1' as JWK kid
- mentioned on