Skip to content

Add private key jwt auth - #1241

Draft
julien-nc wants to merge 25 commits into
mainfrom
enh/noid/private-key-jwt-auth
Draft

Add private key jwt auth#1241
julien-nc wants to merge 25 commits into
mainfrom
enh/noid/private-key-jwt-auth

Conversation

@julien-nc

@julien-nc julien-nc commented Oct 28, 2025 •
edited
Loading

Copy link
Copy Markdown
Member

Implement the "Private key JWT client authentication" flow.

https://auth0.com/docs/fr-ca/authenticate/enterprise-connections/private-key-jwt-client-auth
https://www.keycloak.org/securing-apps/authz-client#_client_authentication_with_signed_jwt
https://docs.developer.singpass.gov.sg/docs

  • Generate key pair for signature
  • Implement refresh mechanism for signature key
  • Implement the client assertion JWT generation to be passed to the IdP on login
  • Generate key pair for encryption (for the provider to potentially generate a JWE returned by the token_endpoint)
  • Implement refresh mechanism for encryption key with key rotation
  • Adjust the code endpoint to detect if we got a JWE or a JWT from the token endpoint, act accordingly
  • Add doc to README
  • New provider-specific setting to toggle this new authentication method
  • Add hints in the settings UI
  • Make it possible to force-enable PCKE even when no code_challenge_methods_supported is found in the discovery endpoint's payload
  • Add a regexp mechanism to extract user IDs from a token attribute
  • double check logic of signature key rotation
  • implement proper encryption key rotation like for the signature ones

@julien-nc julien-nc self-assigned this Oct 28, 2025
@julien-nc julien-nc added enhancement New feature or request feature request labels Oct 28, 2025
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 4 times, most recently from 56cc2a7 to 352567d Compare November 4, 2025 16:20
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 4 times, most recently from 8dc4e0e to 6d08fc0 Compare November 13, 2025 13:46
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 6 times, most recently from 8369165 to 4dd4ac7 Compare November 20, 2025 09:51
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 4 times, most recently from 465d587 to 5e9e3c5 Compare December 1, 2025 11:42
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 3 times, most recently from 343a387 to a7f1707 Compare December 22, 2025 14:50
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 3 times, most recently from 61abd9a to 8131815 Compare December 25, 2025 12:21
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 2 times, most recently from 1b59339 to ebde1bc Compare January 9, 2026 13:44
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch from ebde1bc to 76023aa Compare January 23, 2026 09:37
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch from 5db9242 to 2c1e0e8 Compare February 17, 2026 10:05
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch 2 times, most recently from ed457bd to 28de290 Compare March 11, 2026 17:48
julien-nc added 23 commits March 26, 2026 12:41
@julien-nc
gen ssl key pair and convert the public key to JWK
cd5a08b 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
store pem priv key in appconfig, gen JWK from public ssl key, test cr…
18bbc9a 
…eating and decoding JWT from our key

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
use EC signature key with P-384 curve
2799185 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
generate/store/refresh encryption key
7aa458f 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
add lint-eslint action
7d1a1ec 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
add new boolean setting to enable private key jwt auth
0590bb1 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
implement private jwt login flow by passing the client assertion to t…
9ae4166 
…he token endpoint

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
adjust README and settings UI
f0ff9f2 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
increase key lifetime to one hour, add comments on when/why we refresh
a98ce4e 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
implement small signature key tests
94920d5 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
implement small encryption key tests
a272ab5 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
implement JWE encryption + decryption with algos working with singpass
b2b1dbb 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
implement JWE tests
dab8d05 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
polish
ee26b13 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
tests
0495067 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
last part: detect if a JWT is in a JWE on login
ccce6e1 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
make it possible to force-enable PKCE
a0348aa 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
add error description in 403 template, use it in code controller method
d3f9d9c 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
add regexp mechanism to parse user IDs from tokens
704ea0c 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
make debug endpoints private
8123a16 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
handle errors when parsing JWT header at the end of the code flow
f3f8c97 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
include leading and trailing / in the userId regexp
41be3fe 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
implement encryption key rotation for JWE decryption
4fc9d40 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch from 28de290 to 4fc9d40 Compare March 26, 2026 11:48
@julien-nc
do not log sensitive data, fix user_id regexp logic, only decrypt cli…
12950b5 
…ent secret if needed

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
[WARNING] needs logic check: improve signature key rotation
1e57757 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
@julien-nc
julien-nc force-pushed the enh/noid/private-key-jwt-auth branch from 946171a to 1e57757 Compare March 26, 2026 14:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@juliusknorr juliusknorr Awaiting requested review from juliusknorr juliusknorr will be requested when the pull request is marked ready for review juliusknorr is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@julien-nc julien-nc

Labels

enhancement New feature or request feature request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@julien-nc