Support the symmetric signature verification

[sberyozkin]

It can be possible that the the server itself creates and signs the original JWT token to be used later for the cookie-based authentication (ex, JHipster). To access such tokens via MP JWT Api smallrye-jwt needs to optionally support the hash HS* algorithms which are currently blocked and then a user would just set a whitelist property enabling HS*.
The major change would have to be done in KeyLocationResolver. It will only be supported for the keys stored in the JWK format, and the verificationKey property would have to become just a Key type.
The somewhat unfortunate bit is that the location property is called mp.jwt.publickey.location, so a smallrye.jwt.secretkey.location would likely need to be introduced (it is unlikely the secret keys will be supported at the spec level)

[gustf]

Hi, do you have any information if and when this will be prioritized?

[sberyozkin]

@gustf Hi, I'll try to look into it asap

[gustf]

@sberyozkin awesome! 👍

[gustf]

@sberyozkin any news regarding this issue?

[sberyozkin]

@gustf Sorry, missed your ping. The initial support will be available in smallrye-jwt-2.2.0 directly from the injectable JWTParser, but more work will need to do a solution which will work for both verification and decryption symmetric keys.

[gustf]

ok thanks!