Can I register an IDP with multiple certificates on AWS IAM

0

What I have is:

An OpenId Complaint service (Rest) that provides tokens
This service has multiple certificates (keyPairs) for signing tokens depending on some factors when requesting a token

  • The service is implementing the 2 OpenId Endpoints (well known and certs)
    What I did:

I registered the service as an IDP on AWS IAM service successfully (hence my two OpenId Endpoints are working other wise AWS wont accept the IDP)
I created roles on IAM that are to be assumed using the IDP service tokens
I got two tokens from the IDP service to be used for assuming role (each signed with different key)
Problem:

AssumeRole is failing and I'm getting invalid token exception for both tokens.
I tried to set the "kid" claim in the tokens each with the corresponding kid of the certificate and it didn't work :(.

Note:

I'm assuming role using Java AWS API
When I remove one of the certificates (from the below sample response) the remaining certificate works fine. So the problem is with having 2 certs, but I need to have two certificates and AWS should have a way of working with such case I just don't know how.
Sample of how my certs endpoint looks like:

{
"keys": [
{
"kid": "kid",
"kty": "kty",
"use": "use",
"alg": "alg",
"n": "nValue",
"e": "eValue",
"x5c": [
"cert1"
],
"x5t": "x5t=",
"x5t#S256": "x5t#S256"
},
{
"kid": "kid1",
"kty": "kty",
"use": "use",
"alg": "alg",
"n": "nValue",
"e": "eValue",
"x5c": [
"cert2"
],
"x5t": "x5t=",
"x5t#S256": "x5t#S256"
}
]
}

Edited by: hfakih on Feb 10, 2020 6:49 AM

hfakih
asked 4 years ago221 views
1 Answer
0

So the problem was that I tried to set the kid in the "claims" of the JWT.

However it turned out that ,in order for AWS to distinguish that this JWT was signed with this key (from the jwks response), it checks in the headers of the JWT. If a kid is found in the header then it looks in the jwk response for the certificate with the corresponding kid.

So to solve the issue I just had to set the kid of in the "headers" of the JWT.

So if you are in java :

public String buildToken(Key key) {
Map<String, Object> claims = new HashMap();
Map<String, Object> headers = new HashMap();

claims.put(claimName, someClaim);  
...  
headers.put(KID, KID_OF_THIS_TOKENS_CERTIFICATE);  
...  
return Jwts.builder().setClaims(claims).setHeader(headers).signWith(SignatureAlgorithm.RS256, key).compact();  

}

hfakih
answered 4 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions