Invalid JsonWebKey when it is ECDsaSecurityKey at DiscoveryResponseGenerator

[brunobritodev]

We can only help you if you are on the latest version. Either use the latest 2.x or 3.x
Latest version: 3.1

Issue / Steps to reproduce the problem

At AddSigningCredentials is possible to pass as argument some SecurityKeys (RSA, ECDsa...).

If you create a ECDsaSecurity and convert it as JsonWebKey, then IdentityServer4 dont get crv parameter from JsonWebKey.

At our prod servers we decided to keep all SecurityKeys in Microsoft.IdentityModel.Tokens.JsonWebKey form. So it's easily to manage and store them. But we caught this bug in our Production server when we changed from PS256 to ES256.

jwks_uri endpoint:

1 - ECDsaSecurityKey
2 - RSA...
3 - JsonWebToken with ECDsaSecurityKey params.

Bug at DiscoveryResponseGenerator.cs:

// line 474
                else if (key.Key is JsonWebKey jsonWebKey)
                {
                    var webKey = new Models.JsonWebKey
                    {
                        kty = jsonWebKey.Kty,
                        use = jsonWebKey.Use ?? "sig",
                        kid = jsonWebKey.Kid,
                        x5t = jsonWebKey.X5t,
                        e = jsonWebKey.E,
                        n = jsonWebKey.N,
                        x5c = jsonWebKey.X5c?.Count == 0 ? null : jsonWebKey.X5c.ToArray(),
                        alg = jsonWebKey.Alg,
                         // Maybe here should have crv:
                        x = jsonWebKey.X,
                        y = jsonWebKey.Y
                    };

                    webKeys.Add(webKey);
                }

[leastprivilege]

Thanks. Merged.

Hi,

merged to master. If you want that fix to appear in 3.1.1, please do a PR against

https://github.com/IdentityServer/IdentityServer4/tree/releases/3.1.x

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.