No kid header is set during the connector authentication with a authorization provider.

[scandinave]

Bug Report

Describe the Bug

No kid header is set into the sign JWT request during authentication of the connector.

Expected Behavior

Set the kid header, so the authorization provider can know which key has been used to sign the assertion token.

Observed Behavior

The kid is not set

Steps to Reproduce

Steps to reproduce the behavior:

1. Make a call to the management API of a connector that is secured by an authorization provider. (Fetch the catalog for example)
2. The connector authenticate to the authorization provider to get a valid token to be allowed to make a request to the target connector
3. Intercept this request with tools like Wireshark
4. The request does not contain the kid of the key used to sign the client assertion.

Context Information

Add any other context about the problem here.

• Used version 0.11.0

Detailed Description

Some authorization provider (like Keycloak), will only pick the first key exposed by a JWKS endpoint if no kid header is available. This cause issues if we want to expose multiples keys on an endpoint for scenario like key rotation.

Possible Implementation

In the Oauth2ServiceExtension,

jwtDecoratorRegistry.register(OAUTH2_TOKEN_CONTEXT, Oauth2AssertionDecorator.Builder.newInstance()
                .audience(config.getProviderAudience())
                .clientId(config.getClientId())
                .clock(clock)
                .validity(config.getTokenExpiration())
                .kid(certificate.getSerialNumber().toString()) // Add this line to generate a keyid. 
                .build());

KeyId as serial number is the format used by nimbus-jose.

[paullatzelsperger]

This area of code, in particular the OAuth2ServiceExtension is deprecated and is scheduled for removal soon.
If your project uses OAuth2 as central identity provider, I recommend that you copy the extension into your own code base and maintain it there.

The EDC project will not invest in deprecated code.