Question Recurring issue with decode of JWT token when using oauth2 login mechanism

F

FrankW

New Member
We have a webapplication in which users can login using O365/Oauth2.

Every 3 months (which is also the rolling time of the keys at microsoft) some people can no longer login to the application.

The error shown is:

{ "error_description": "An error occurred while attempting to decode the Jwt: Signed JWT rejected: Invalid signature", "error": "invalid_token", "error_uri": "......." }

A simple restart of the PASOE fixes this issue. Also note intermediate restarts don't help or postpone the issue.
Also this does not happen on all computers. Even with the same account. If you try this on multiple computers it will work no problem, and on others it will never work. Like said above, until we restart the PASOE, then everything works fine again.


It looks like a problem of the rolling keys.
But
  1. like already mentioned: the exact same account does work on some computers.
  2. If I decode the JWT token that gives the error, with some online web tools, this will say all keys are correct
  3. Also if I look on our server what keys are currently used, the key in the JWT does show up as a valid key


Any pointers of what is happening and why and how to fix this?
 
I'm pretty sure there's a bug in pasoe. When pasoe starts, it downloads the public keys from the well known endpoint. At some point in time, the keys are rolled on the auth server.

Any old token that hasn't expired will still work, because it's verified using the cached public keys. However, any new auth that uses the new public key on the auth server hits pasoe, and pasoe then can't find the key to use to verify

I think pasoe is meant to then check the well known endpoint and download new keys but it seems not to

this is easily tested by setting the key rotation to a minute or something :)
 
jmls said:
this is easily tested by setting the key rotation to a minute or something :)
Click to expand...
I am not sure how I would do this as I am not a microsoft employee ?
Do you mean by setting up our own oauth server that has a key rotation of a minute?

Also note that people can also login using Google into our app.
At Google the keys rotate every week. For Google we never have this problem. Only for Microsoft.
 
Jeez, I was just saying what we see in our pasoe app. We have our own oauth server that we can control so it was easy to test the rotating public key theory.
 
jmls said:
Jeez, I was just saying what we see in our pasoe app. We have our own oauth server that we can control so it was easy to test the rotating public key theory.
Click to expand...
Sorry for the misunderstanding.

So if I understand correclty. You are experiencing this exact same issue within your app against your own oauth server?
 
indeed - and being able to change the rotation at will helps prove it. The only thing I am concerned about is if we have missed some config option to force a refresh of the keys ...
 
You must log in or register to reply here.
Back
Top