keyfunc: failed keyfunc: could not find kid in JWT header

[Eigen438]

Hi.

I encountered an error in the title while testing OpenID Connect.
keyfunc considers kid as a required parameter, but according to RFC-7517 (4.5) kid is optional and may be absent.

In the following cases, id_token must pass signature verification.

jwks

{
  "keys": [
    {
      "kty": "RSA",
      "e": "AQAB",
      "use": "sig",
      "n": "uukX5Yo8pM4nFFSQ4ZdinfAnm2cxPDnEeMgTW39Mn_WBUUuP9OkxgJEfCc-_le963N36bpv14fb830eBS2Weld7UhYQQFx48bhBd6OY8NRZJV7Dg1Ub0YdXwfgKPkdbBZLbCpu3FK_KY5aXJKn8nTY-64s37fl91AOlYB2Q-0Q2D1NweRsH-mP5RV9gMG6q5tNhLmbCfDiL2vV2KVMUq2LsoGKF-f5ZzmVlHGy6UDgkC3BH0N7o5nJh_0iyXBieORtFb6TPP3pw-ER9QSLVhLfTUrnXTlhqyAsToaHXstX66JJaZQ_WjqCtiKhLr22809OPOE59g6TKHp6d2ea-saw"
    },
    {
      "kty": "EC",
      "use": "sig",
      "crv": "P-256",
      "x": "4u93KgJZgf1ISOCLSEXTq4GKrwM7hdnkP2m1eQsnHaY",
      "y": "xs1zTvc3yyCIGeWq3poV-T9DqqteP4d5CVTc04qJna0"
    },
    {
      "kty": "EC",
      "use": "sig",
      "crv": "secp256k1",
      "x": "76uOYhPihVpUp2OodREkQZD3pyGKeEzAefzuWGyAPxg",
      "y": "y54_2iPVOUScCYsG81_H-dD-ToSeR8_z0U9aKNkC6Ug"
    },
    {
      "kty": "OKP",
      "use": "sig",
      "crv": "Ed25519",
      "x": "Lf5MH_DJG5UfEDyi5g9VPZ6OAFzhsXUU7qiItvJgpcM"
    },
    {
      "kty": "RSA",
      "e": "AQAB",
      "use": "enc",
      "kid": "371cd27d-a43d-43df-aee0-1de48680307f",
      "alg": "RSA-OAEP",
      "n": "xHudfO1LjEUCx-cpvm4d9bIYRnjuW5lEQSpN0OgvwgDjeu1tludfUGd6hvvH8Qyhtti_GTdz2g5x5Iq3hSd9vcv-VlYR18PHTFuaGisxXwPyqG6qnxL6KizuyXMrkLHXkCP-e_gSN-CTcy7jdGNiYsafnkvSaY87Y_bk4B-tHnmiy750NYpMszp2su64BtzD-qFRkfcFawWbbtOIq1iIyCvE3eMg4Phu5GTK3JQLC-iKTl-yRNN_vUd0CvpBRud6X7JuxGCwV_n2yUy5PTYMJwYWEeDoZu55l2VCVK9vDddDVEp72V3mrrq1DMXMNAD_zCbQjV2iJJFFLsVMa4JYLw"
    },
    {
      "kty": "EC",
      "use": "enc",
      "crv": "P-256",
      "kid": "487710c5-e29f-4f8b-a97e-1f9505c756e6",
      "x": "JuU4Z3N1v6bMyk_a3f1D9_xYbEoysjcEZxFJbfCvkvk",
      "y": "OxuXJZY0dxCRPw6_BAGmmUrK0n6kO5OVep258M5I59Q",
      "alg": "ECDH-ES"
    }
  ]
}

jwt(id_token)

eyJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiakRkbDdSUXdVT24xVE5hX0NtTi1vdyIsInN1YiI6InVzZXItc3ViamVjdC0xMjM0NTMxIiwiYXVkIjoiZGVmYXVsdCIsImlzcyI6Imh0dHBzOi8vd3d3LmNlcnRpZmljYXRpb24ub3BlbmlkLm5ldC90ZXN0LzJvNGhZdDU3UU1zTmx4UC8iLCJleHAiOjE3MjYxMTkyNjksImlhdCI6MTcyNjExODk2OX0.DAIgDtaglNDTnU8QC-UmqARiO0QG1EzxIo1Krv_EUv9ZHYj5qG1rVrlWPTkhqO0Azw3j3_jK4J1h9VvzeH6_AxtCs-dV9wLBDL_gogDywh-skYYZ_WihvLeSmfHoP-fl8NQxZRJ118Nu3EOcxor85RaeKp3FrTpEqOG94yhgSZ-4mN-jJlN_e1jSetE76gRVlsEp_UP4l6c3DXXZ4-d7y5NqO1Rv93KpFwiC22CBy9Iu2lOkqfPIF4aHdjBxgN8BZGMysWO0DbSqE3fLFD51FzP5NkNvveqV3XPLI9eLMyK7kWswLIcgeFtL7xkv8krw4TLBUBcugcLfgcGAZdtc-w

I hope you can resolve this issue.
thank you.

[MicahParks]

@Eigen438 thank you for providing a JWK Set and JWT.

It has been a while since I have considered matching keys on something besides the Key ID kid. From what I remember, I have no plans to match on anything but the kid because of the scope of this package.

The scope of this package is to provide a jwt.Keyfunc for the github.com/golang-jwt/jwt/v5 package. Below, I've copied the definition of jwt.Keyfunc:

// Keyfunc will be used by the Parse methods as a callback function to supply
// the key for verification.  The function receives the parsed, but unverified
// Token.  This allows you to use properties in the Header of the token (such as
// `kid`) to identify which key to use.
//
// The returned interface{} may be a single key or a VerificationKeySet containing
// multiple keys.
type Keyfunc func(*Token) (interface{}, error)

Due to the documentation and signature of this function, the github.com/MicahParks/keyfunc project only gets one return value with no retry logic.

Since key selection retry logic is not available in the jwt.Keyfunc implementation, if I were to add code that selected a key on something other than a unique identifier, such as algorithm, the wrong key may be returned and the users of this project would likely have some confusing JWT parsing errors to debug.

My suggestion to you would be one of two things:

1. If you control the JWK Set and JWT signing, assign Key IDs, kid, to each JWK in the set and place the kid in the header of the signed JWT. This project should become helpful after that.
2. If you cannot do the above, use the github.com/MicahParks/jwkset project to edit your JWT parsing logic. You should implement custom key selection logic or iterate through all keys with retry logic. You can read all keys with the .KeyReadAll method on the jwkset.Storage implementation you are using.

[Eigen438]

Thank you for your comment. @MicahParks

I will try to implement it using the method you suggested.

[MicahParks]

@Eigen438 there is a way to return all keys for JWT signature verification using jwt.VerificationKeySet. That feature is supported in v3.5.0