JWT Verification ES512 alg

markruscitto · October 7, 2020, 10:09pm

Hi , My JWT Verification is failing, with this error:

jwt.JWT-Verify.error	Could not find a matching Public Key: policy(JWT-Verify)

the policy config:

<VerifyJWT>
  <DisplayName>JWT-Verify</DisplayName>
  <Algorithm>ES512</Algorithm>
  <Source>pingaccess_jwt</Source>
  <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables> 
  <TimeAllowance>120s</TimeAllowance>
  <PublicKey> 
    <JWKS ref="calloutResponse.content"/> 
  </PublicKey> 
</VerifyJWT>

In the trace I can see the value of the kid in the JWKS variable and it matches the value of the kid from the decoded jwt header in the flow. This is the first time verifying an ES type of signature. I never had to parse the JWKS for any of the other signatures I’m wondering if I have to do something different with JWKS or if my policy config is off?

Here are the values from the trace:

jwt.JWT-Verify.header-json	{“kid”:“2c”,“alg”:“ES512”}
jwt.JWT-Verify.header-claim-names	[kid, alg]
jwt.JWT-Verify.header.kid	2c
jwt.JWT-Verify.decoded.header.kid	2c
jwt.JWT-Verify.header.algorithm	ES512
jwt.JWT-Verify.decoded.header.alg	ES512
jwt.JWT-Verify.signed	true
jwt.JWT-Verify.is_expired	false

calloutResponse.content

{
    "keys": [
        {
            "kty": "EC",
            "kid": "2f",
            "use": "sig",
            "alg": "ES512",
            "x": "AWNMBFYqbwYHMO1Zv9aYHyrIbXp4yFWJ5QiBuZ4yLMWyZPS7UhiuO0iwkE9gvyKQXI_6a0VXiiyk4NBhG4q9hKMH",
            "y": "AQln3coV6WAf-wHoVaehovYio0Foys_6xC4U8UzLzo88fgCxVUW8QsYiEmQ_tSt50EUFAKggp8nt2X_GER2iVE4K",
            "crv": "P-521"
        },
        {
            "kty": "EC",
            "kid": "2e",
            "use": "sig",
            "alg": "ES384",
            "x": "OZd3IT_NRIgtJdPiErW7EA2FtSlizmdLNGpq65WjCZUA7EpVAVQDYRnVYQYYFIG2",
            "y": "j4hRRaZ3BprvkyPF9NB2Kpxz1dr5jn9g9czJZ4znguB9GF989hNjCtlo00Ud2SRe",
            "crv": "P-384"
        },
        {
            "kty": "EC",
            "kid": "2d",
            "use": "sig",
            "alg": "ES256",
            "x": "kr2UZc2wKlw5szdFypPNvPx6bRhFanftadAfidt6TNo",
            "y": "_OslA7C8NV6Psj2ohIE1j90BmBeVPmxwcvZcbSBROUk",
            "crv": "P-256"
        },
        {
            "kty": "EC",
            "kid": "2c",
            "use": "sig",
            "alg": "ES512",
            "x": "AN82cL5862dMJb9Xpc2NbUyeWJQ1ZXFn3Hh5UrmTiVDXw5TJBzA9vSf23pbdafjWfK2fmMlEsZvoVUpZIjkrvSVM",
            "y": "AOxsGYubw7gfgkBonCZYQepwUxptQnzwwm2t7QsyiaPiSNuitig4bMsX-Fn51jMX96wv0Mel0RmyBb3TAKBk9yB6",
            "crv": "P-521"
        },
        {
            "kty": "EC",
            "kid": "2b",
            "use": "sig",
            "alg": "ES384",
            "x": "JPkD7llgmS-QbtzPSr-CZYPqHsg5_MiD5JhWjqPAmJqD1k3YuiYJd5pNggRdUs4s",
            "y": "cUxzohl3jAWPc-kMkMSBW07IF2kn7My4RSxJ6J_cfUmp6TlSYHYsMbYyu31yH8VM",
            "crv": "P-384"
        },
        {
            "kty": "EC",
            "kid": "2a",
            "use": "sig",
            "alg": "ES256",
            "x": "cxATmhdy2XFmhLduY31M40Bu07BWG2V3Ir1BfqiMCaY",
            "y": "0vMNiil72Ms7cIegxqd9iveSINegVT3g9m_G666YNI4",
            "crv": "P-256"
        },
        {
            "kty": "EC",
            "kid": "29",
            "use": "sig",
            "alg": "ES512",
            "x": "AAfuPBgdZI8TSrcMTr_T_CEd5NS0iVaVoOQLm5RsvCAWzqWieXPNoS0oqWc60RScSy-95UF0UMlXf35sE7JFcTQa",
            "y": "AF-XqNeMFQtUV_-mcAlN90020BAOf6CLKumULq_SHKp0YLHq68M3Kncl-0GA7_fXdEMAYT1DyDkDgYS-32Y-sBho",
            "crv": "P-521"
        },
        {
            "kty": "EC",
            "kid": "28",
            "use": "sig",
            "alg": "ES384",
            "x": "wPWR927JlnSsZSZLGjsKjsx00pv6bI4ckB1_igpSTy5icB6SKhcaL6d9o1LUGh0p",
            "y": "Xd-9dCwJ2gXXvJBeUNJQ50v3nxnO0_kJBADxaTCBKVVLFkPDWkS8Jk8hhJiaOU0s",
            "crv": "P-384"
        },
        {
            "kty": "EC",
            "kid": "27",
            "use": "sig",
            "alg": "ES256",
            "x": "_JvPT2ftA5t3KiNysEfYmMnrIXgcU8liAckXJpzDTaU",
            "y": "2cs6FAkfvMJfCoiET8C6lH-VotMG5SP0KDY3hPU0jN8",
            "crv": "P-256"
        }
    ]
}

Thanks for your help.

markruscitto · October 8, 2020, 1:49pm

I went ahead and hardcoded the jwks so it had only the key that matched it still does not match.

pingjwks	{“keys”:[{“kty”:“EC”,“kid”:“2c”,“use”:“sig”,“alg”:“ES512”,“x”:“AN82cL5862dMJb9Xpc2NbUyeWJQ1ZXFn3Hh5UrmTiVDXw5TJBzA9vSf23pbdafjWfK2fmMlEsZvoVUpZIjkrvSVM”,“y”:“AOxsGYubw7gfgkBonCZYQepwUxptQnzwwm2t7QsyiaPiSNuitig4bMsX-Fn51jMX96wv0Mel0RmyBb3TAKBk9yB6”,“crv”:“P-521”}]}
jwt.JWT-Verify.error	Could not find a matching Public Key: policy(JWT-Verify)

jwt.JWT-Verify.header-json	{“kid”:“2c”,“alg”:“ES512”}
jwt.JWT-Verify.header-claim-names	[kid, alg]
jwt.JWT-Verify.header.kid	2c
jwt.JWT-Verify.decoded.header.kid	2c
jwt.JWT-Verify.header.algorithm	ES512
jwt.JWT-Verify.decoded.header.alg	ES512
jwt.JWT-Verify.signed	true

dchiesa1 · October 8, 2020, 2:49pm

can you try removing the use=“sig” from the JWKS ?

dchiesa1 · October 8, 2020, 2:57pm

What version of Apigee are you using? You’ve used VerifyJWT successfully before, is that right?

And can you show me the VerifyJWT policy configuration?

markruscitto · October 8, 2020, 4:00pm

Hi Dino

I had to hardcode the jwks and modify it to remove the “use”:“sig” attribute. Once I did this it worked. I’m not sure if our internal team can modify the jwks to omit the above. At least we have something that will work and can work around it for now.

Thanks for your timely help!

markruscitto · October 8, 2020, 4:01pm

Hi Dino

I had to hardcode the jwks and modify it to remove the “use”:“sig” attribute. Once I did this it worked. I’m not sure if our internal team can modify the jwks to omit the above. At least we have something that will work and can work around it for now.

Thanks for your timely help!

markruscitto · October 8, 2020, 4:17pm

Dino,

We have multiple apigee versions in use at different locations. Our main on prem install is at © 2020 Apigee Corp. All rights reserved. Version 4.19.01.00. This version does not have support for the ES512 algorithm. Does this have support for ES512? https://github.com/apigee/iloveapis2015-jwt-jwe-jws

Or we need to build our own?

Thanks again

Mark

dchiesa1 · October 8, 2020, 6:36pm

Oh, I’m glad to hear that you solved the problem!

There was an error in key selection in which the logic within the VerifyJWT policy incorrectly filtered out a JWK with the “use” property. We have since fixed that bug, but it remains in OPDK 4.50.00.

I expect that you’ll get the fix in a future patch for OPDK.

markruscitto · October 8, 2020, 7:19pm

Sorry Dino I didnt mean to take credit for the answer! Im not sure how to assign it to you.

dchiesa1 · October 8, 2020, 7:56pm

Mark - don’t worry! I moved your comment to an answer and “accepted” it.

I’m not concerned about who gets credit. I really appreciate your use of the community, asking your question so clearly, and then following up and explaining what you did to solve the problem. That will help people in the future, it’s valuable information. Thanks for contributing!

API-Evangelist · October 9, 2020, 11:32pm

What all use case you are looking specific to ES512? jwt creation/verification?

reason being recently we extended it to support PS256 & it is not hard to to do for ES.

Mohammed-Mahtab · June 26, 2024, 8:08am

Thanks , I was struggling with the same issue , and now i know this issue within OPDK 4.50.00 version still remains . the current version that i am using .

jwt.Verify-JWT.header.algorithm: ES384 and the error :Could not find a matching Public Key: policy(JWT-Verify)

I tried the solution given by @markruscitto to hardcode the jwks and modify it to remove the “use”:“sig” attribute. it works but not comfortable to change the public Key /JWK “use”: “sig”, in production .

Currently, I am going with Java Callout as created verifications part in java

dchiesa1 · June 26, 2024, 1:11pm

You don’t need to hard-code the JWKS. If you like, You can perform a ServiceCallout to retrieve the jWKS, and then use a JS step to transform it within the proxy to remove that element.

var c = JSON.parse(context.getVariable('jwksCallout.content'));
c.keys.forEach(function(key) {
  delete key.sig; 
});
context.setVariable('transformedJwks', JSON.stringify(c));

And then refer to transformedJwks in the VerifyJWT policy.

Mohammed-Mahtab · June 26, 2024, 1:59pm

Thanks , Yes I, tried this way already and it works , but the question is what is best practice ? modify the key and refer to transformedJwks in the VerifyJWT policy or without modifying the key and verify in Java code itself ?

dchiesa1 · June 26, 2024, 4:22pm

I would say, modifying the JWKS seems easier, and I’d prefer that, over the other option you described.

BUT,

the BEST practice is an option you did not identify: update to OPDK 4.52 which does not have this problem!

Topic		Replies	Views
Could not find a matching Public Key: policy(verifyJWT) -Error Apigee api-runtime	9	117	June 12, 2023
steps.jwt.noMatchingPublicKey when trying to validate a EC256 signed JWT tocken using JWKS Apigee apigee-general	1	17	May 20, 2022
Verify JWT failed when using JWKS Apigee apigee-x , apigee-general , developer-portal	1	92	January 16, 2025

JWT Verification ES512 alg

AI Suggested topics