Add private key jwt auth - #1241

Draft

julien-nc wants to merge 25 commits into

mainfrom

enh/noid/private-key-jwt-auth

Commits on Mar 26, 2026

gen ssl key pair and convert the public key to JWK
julien-nc
committed
cd5a08b
store pem priv key in appconfig, gen JWK from public ssl key, test creating and decoding JWT from our key
julien-nc
committed
18bbc9a
use EC signature key with P-384 curve
julien-nc
committed
2799185
generate/store/refresh encryption key
julien-nc
committed
7aa458f
add lint-eslint action
julien-nc
committed
7d1a1ec
add new boolean setting to enable private key jwt auth
julien-nc
committed
0590bb1
implement private jwt login flow by passing the client assertion to the token endpoint
julien-nc
committed
9ae4166
adjust README and settings UI
julien-nc
committed
f0ff9f2
increase key lifetime to one hour, add comments on when/why we refresh
julien-nc
committed
a98ce4e
implement small signature key tests
julien-nc
committed
94920d5
implement small encryption key tests
julien-nc
committed
a272ab5
implement JWE encryption + decryption with algos working with singpass
julien-nc
committed
b2b1dbb
implement JWE tests
julien-nc
committed
dab8d05
polish
julien-nc
committed
ee26b13
tests
julien-nc
committed
0495067
last part: detect if a JWT is in a JWE on login
julien-nc
committed
ccce6e1
make it possible to force-enable PKCE
julien-nc
committed
a0348aa
add error description in 403 template, use it in code controller method
julien-nc
committed
d3f9d9c
add regexp mechanism to parse user IDs from tokens
julien-nc
committed
704ea0c
make debug endpoints private
julien-nc
committed
8123a16
handle errors when parsing JWT header at the end of the code flow
julien-nc
committed
f3f8c97
include leading and trailing / in the userId regexp
julien-nc
committed
41be3fe
implement encryption key rotation for JWE decryption
julien-nc
committed
4fc9d40
do not log sensitive data, fix user_id regexp logic, only decrypt client secret if needed
julien-nc
committed
12950b5
[WARNING] needs logic check: improve signature key rotation
julien-nc
committed
1e57757

Navigation Menu

Uh oh!

Add private key jwt auth - #1241

Add private key jwt auth#1241
julien-nc wants to merge 25 commits into
mainfrom
enh/noid/private-key-jwt-auth

Commits on Mar 26, 2026

gen ssl key pair and convert the public key to JWK

store pem priv key in appconfig, gen JWK from public ssl key, test creating and decoding JWT from our key

use EC signature key with P-384 curve

generate/store/refresh encryption key

add lint-eslint action

add new boolean setting to enable private key jwt auth

implement private jwt login flow by passing the client assertion to the token endpoint

adjust README and settings UI

increase key lifetime to one hour, add comments on when/why we refresh

implement small signature key tests

implement small encryption key tests

implement JWE encryption + decryption with algos working with singpass

implement JWE tests

polish

tests

last part: detect if a JWT is in a JWE on login

make it possible to force-enable PKCE

add error description in 403 template, use it in code controller method

add regexp mechanism to parse user IDs from tokens

make debug endpoints private

handle errors when parsing JWT header at the end of the code flow

include leading and trailing / in the userId regexp

implement encryption key rotation for JWE decryption

do not log sensitive data, fix user_id regexp logic, only decrypt client secret if needed

[WARNING] needs logic check: improve signature key rotation