oidc: support kid hint in header

[aeneasr]

I'm trying to use https://github.com/IdentityModel/oidc-client-js with Hydra. It seems to work when I use response_type=token, but fails when I add id_token. It says "No kid found in id_token" (I checked, there's no kid).

Reported by @janekolszak

[janekolszak]

I think this log contains the bad response

time="2016-08-20T10:40:17Z" level=info msg="completed handling request" measure#web.latency=186782098 method=GET remote=172.23.0.1 request="/oauth2/auth?client_id=wta-site&redirect_uri=https%3A%2F%2Flocalhost%2Ftestoidc%2F&response_type=id_token%20token&scope=openid%20all&state=995787dc2625419387b4ffd90d0bdab7&nonce=a96fca455a4644eaadd2847f7e2d84d6&consent=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJ3dGEtc2l0ZSIsImV4cCI6MTQ3MTY4OTkxNywiaWF0IjoxNDcxNjg5NjE3LCJzY3AiOlsib3BlbmlkIiwiYWxsIl0sInN1YiI6IjY2ZWM5Njc5LWNmZDgtNDI0My05ZmEyLTQ4ZTVjOTI5YzFjMiJ9.QT38PSu0PU5i1qoQtXWAU3Y8-hUMuVF1Uw-I9DCpU88pYD-ndtrIrMm4ksyeecY3JibPHizcBb6QOeFHR3g1AKGiXl76wY6LsQwW7RXxCuNom9WWXOMZD0CpSxR_nlaiqmhnxDlPG4NiyHTr415p325wGZ7S2eUkNtDaXeCDgTijPCe8fz08YliCk6NgMyL0mXHYk3gyjaYybV8ulCPtYKLUz6vsfUWkojbTKVfgJluX1Xz62c8t53_1ckzfw1YPY67wGGr1tlDJTTOucMxb1QqDc-lVR0jfC0rjqLhzQzJOsmwjGcybrHH6-TuEGAr6s_eZj-U0GTQX46eh9QN0rOEMG8Y5YkMoUgQQA8GFaTFB0ICvBCuQgYMJ9Gr8CDvOWI2pQ0jknsZlUjt4Eh6Pb4IqZzpWnNQnyBQ76E_HjIcm9fpo7iyQzslz-80n9vHdhBnunm1xkmHR0lDCfR608J7Ko5tmrhMJwUgC_MHo7PehKEif35XkNYBaRPZVFTb4t5K0UxalMt6S6uTyEsjD7uzQUDSYdnM_Mj4zcT47obCt_VCC0amr1NpY6-yPQQu05aIcnJv62FBCTLzpU85ywZHiWUE7GYNFAKll1b0GJX1pB8HCRrFgQueSlKDmjik31oeM7dvw_fHj6DhArDFUMQgRYSk6tpfGg_DLSTyKQOo" status=302 text_status=Found took=186.782098ms 

[janekolszak]

Decoded with https://jwt.io/

{
  "alg": "RS256",
  "typ": "JWT"
}
{
  "aud": "wta-site",
  "exp": 1471689917,
  "iat": 1471689617,
  "scp": [
    "openid",
    "all"
  ],
  "sub": "66ec9679-cfd8-4243-9fa2-48e5c929c1c2"
}

and signature isn't valid

[aeneasr]

What you're showing in #222 (comment) is not the id token, it's the consent token issued by your idp. I'm a bit confused :|

This is what an ID token looks like, if I request it using the demo:

{
  "alg": "RS256",
  "typ": "JWT"
}
{
  "aud": "d7f2ee09-8d28-4be2-bb89-ce3a5e7c3217",
  "auth_time": 1471691398,
  "exp": 1471694997,
  "iat": 1471691398,
  "iss": "hydra.localhost",
  "nonce": "wqwdpdahrbeotxwzqaldhyow",
  "sub": "john.doe@me.com"
}

According to spec, the kid claim is not mandatory in the id token so it can't be missing, please check: http://openid.net/specs/openid-connect-core-1_0.html#IDToken

[janekolszak]

Sorry for that. I can't find what's the id_token returned by hydra.

The id_token validation fails here:
https://github.com/IdentityModel/oidc-client-js/blob/178d19f279bfeb39915db9fc443623605130da33/src/ResponseValidator.js#L246

[aeneasr]

You should be able to request an ID token with an request like this:

https://localhost:4444/oauth2/auth
?client_id=d7f2ee09-8d28-4be2-bb89-ce3a5e7c3217
&redirect_uri=http%3A%2F%2Flocalhost%3A4445%2Fcallback
&response_type=code <- alternatively, `token+id_token`
&scope=hydra+offline+openid <- openid is required, make sure it is included in your consent token
&state=uksnidtqqzrrvfgqaqciaxac
&nonce=rzowrioghmymcrhfapakgfaa

When using hydra token user, the id token will be shown in the console only, not the browser.

[aeneasr]

The ID Token issued by the OpenID Connect Playground doesn't include a kid either.

[aeneasr]

According to http://openid.net/specs/openid-connect-core-1_0.html#Signing a kid may be included if multiple JSON Web Keys are in the JWK Set which was used to sign the key. This is usually required when key rotation is used to identify which key was responsible for signing and reduce computational overhead.

From my point of view, it would be ok to include the kid hint in the header field, even if it's not mandatory. What do you think?