You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@tomee.apache.org by "Richard Zowalla (Jira)" <ji...@apache.org> on 2026/09/25 19:08:00 UTC

[jira] [Closed] (TOMEE-4029) Use of JWKS forces kid to be present in JWTs

     [ https://issues.apache.org/jira/browse/TOMEE-4029?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Richard Zowalla closed TOMEE-4029.
----------------------------------
    Fix Version/s: 11.0.0
                   10.3.0
       Resolution: Fixed

Fixed in https://github.com/apache/tomee/commit/f951316a2e (main) and https://github.com/apache/tomee/commit/5fd2b10bdb (tomee-10.x): with several JWKS keys, a token without kid is verified against the keys' signatures.

> Use of JWKS forces kid to be present in JWTs
> --------------------------------------------
>
>                 Key: TOMEE-4029
>                 URL: https://issues.apache.org/jira/browse/TOMEE-4029
>             Project: TomEE
>          Issue Type: Bug
>    Affects Versions: 9.0.0-M8, 8.0.12
>            Reporter: David Blevins
>            Priority: Major
>             Fix For: 11.0.0, 10.3.0
>
>
> The MicroProfile JWT specification does not mandate that a {{kid}} be present in the JWT for JWKS support to work.
>  
> The specification explicitly states that *if* a kid is present in the JWT, then only that key must be attempted or no key if a matching key does not exist.  The intent is that if the kid is not present each key should be tried.
>  
> This is important for example if a user is currently validating JWTs from system A and those JWTs have no kid.  If at any point the user needs to also accept JWTs from a different system, say system B, another public key would need to be configured.  The only standard support for multiple public keys is via JWKS.  However, we may not be able to force system A or B to now suddenly include a kid in their produced JWTs.  Were this scenario to arise, the current code would never result in a positive authentication and the user would be stuck with no other choice than to abandon use TomEE's MP-JWT implementation.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)