-
Notifications
You must be signed in to change notification settings - Fork 148
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
client assertion does not work when its issuer and subject don't match #437
Comments
Hello @chewong : Sorry for the delayed response. That error message is coming from a package we use, com.nimbusds.oauth2.sdk, which implements the OAuth2 spec and we use it for most of this kind of JWT parsing. I took a quick look through the JWT client spec and it doesn't say that they need to match so I'm not sure why the dependency is checking it, and confirmed with at least the MSAL .NET folks that they library allows it like you said. We'll work on a way to get around that check, unfortunately it's a thing that some other part of the dependency calls so we may need to replace more than just this. I'll update this thread once we have the fix. |
* Allow empty set for scopes. Remove empty string if included in scopes for silent request * Trim scopes * Minor code formatting applied to most files (#417) * Initial commit * Remove info flagged by automated build step (#440) * Remove info flagged by automated build step * Remove unneeded references and test for old Azure Germany cloud * Issue #437 fix - Drop validation on subject and issuer values * Fixed tests * Created new app to fix failing tests * Moving tests to an existing file * Adding copyright line * Adding comments * Bump version numbers for 1.11.1 release (#460) Co-authored-by: Santiago Gonzalez <sagonzal@microsoft.com> Co-authored-by: Santiago Gonzalez <35743865+sangonzal@users.noreply.github.com> Co-authored-by: siddhijain <siddhijain@microsoft.com> Co-authored-by: siddhijain <siddhi0811@gmail.com>
@chewong Latest version of MSAL(1.11.1) is now released that contains fix of this issue. |
The customJwtAuthentication class did not provide the same behavior as the JwtAuthentication class of nimbusds library. The fix for AzureAD#437 is not sufficient to use workload-identity with this msal library. I updated the customJwtAuthentication to make sure it sets the correct body when requesting oauth tokens.
FYI v9.42 of the Nimbus OAuth / OIDC SDK got a fix to support iss != sub: |
Thanks for letting us know @vdzhuvinov ! |
I got the following error:
I have used msal-python, msal-go, msal-net, msal-node, and they all do not require client assertion's issuer and subject to be the same.
The text was updated successfully, but these errors were encountered: