alg parameter in JWKS published by OIDCClientJwksUri

[chrisFrodo]

Hello everyone,

Is it normal that the JWKS published on the OIDCClientJwksUri doesn't contain the "alg" (algorithm) header parameter (like RSA-OAEP) ?

According to the RFC 7517 it's an optional parameter, but some IdP (like Keycloak) need this parameter to choose the right key. The client authentication fails otherwise.

Thanks !

[zandbelt]

The RSA key published on the OIDCClientJwksUri can be used for more than just one algorithm and I'm not sure we can just list all permutations without losing backwards compatibility. I don't think Keycloak should require optional parameters but you can relatively easily work around it by creating your own JWKs document, based on a copy of the OIDCClientJwksUri.