{"action":"created","issue":{"url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3117","repository_url":"https://api.github.com/repos/OpenLiberty/open-liberty","labels_url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3117/labels{/name}","comments_url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3117/comments","events_url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3117/events","html_url":"https://github.com/OpenLiberty/open-liberty/issues/3117","id":314251644,"number":3117,"title":"release bug - OL 18.0.0.1 <mpJwt> configuration ignores the jwksUri attribute","user":{"login":"hrstoyanov","id":5327044,"avatar_url":"https://avatars3.githubusercontent.com/u/5327044?v=4","gravatar_id":"","url":"https://api.github.com/users/hrstoyanov","html_url":"https://github.com/hrstoyanov","followers_url":"https://api.github.com/users/hrstoyanov/followers","following_url":"https://api.github.com/users/hrstoyanov/following{/other_user}","gists_url":"https://api.github.com/users/hrstoyanov/gists{/gist_id}","starred_url":"https://api.github.com/users/hrstoyanov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hrstoyanov/subscriptions","organizations_url":"https://api.github.com/users/hrstoyanov/orgs","repos_url":"https://api.github.com/users/hrstoyanov/repos","events_url":"https://api.github.com/users/hrstoyanov/events{/privacy}","received_events_url":"https://api.github.com/users/hrstoyanov/received_events","type":"User","site_admin":false},"labels":[{"id":738848047,"url":"https://api.github.com/repos/OpenLiberty/open-liberty/labels/Needs%20member%20attention","name":"Needs member attention","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":{"login":"chunlongliang-ibm","id":29715913,"avatar_url":"https://avatars2.githubusercontent.com/u/29715913?v=4","gravatar_id":"","url":"https://api.github.com/users/chunlongliang-ibm","html_url":"https://github.com/chunlongliang-ibm","followers_url":"https://api.github.com/users/chunlongliang-ibm/followers","following_url":"https://api.github.com/users/chunlongliang-ibm/following{/other_user}","gists_url":"https://api.github.com/users/chunlongliang-ibm/gists{/gist_id}","starred_url":"https://api.github.com/users/chunlongliang-ibm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chunlongliang-ibm/subscriptions","organizations_url":"https://api.github.com/users/chunlongliang-ibm/orgs","repos_url":"https://api.github.com/users/chunlongliang-ibm/repos","events_url":"https://api.github.com/users/chunlongliang-ibm/events{/privacy}","received_events_url":"https://api.github.com/users/chunlongliang-ibm/received_events","type":"User","site_admin":false},"assignees":[{"login":"chunlongliang-ibm","id":29715913,"avatar_url":"https://avatars2.githubusercontent.com/u/29715913?v=4","gravatar_id":"","url":"https://api.github.com/users/chunlongliang-ibm","html_url":"https://github.com/chunlongliang-ibm","followers_url":"https://api.github.com/users/chunlongliang-ibm/followers","following_url":"https://api.github.com/users/chunlongliang-ibm/following{/other_user}","gists_url":"https://api.github.com/users/chunlongliang-ibm/gists{/gist_id}","starred_url":"https://api.github.com/users/chunlongliang-ibm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chunlongliang-ibm/subscriptions","organizations_url":"https://api.github.com/users/chunlongliang-ibm/orgs","repos_url":"https://api.github.com/users/chunlongliang-ibm/repos","events_url":"https://api.github.com/users/chunlongliang-ibm/events{/privacy}","received_events_url":"https://api.github.com/users/chunlongliang-ibm/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2018-04-13T21:10:56Z","updated_at":"2018-04-13T23:06:05Z","closed_at":null,"author_association":"NONE","body":"According to this [document](https://www.ibm.com/support/knowledgecenter/en/was_beta_liberty/com.ibm.websphere.wlp.nd.multiplatform.doc/ae/twlp_sec_json.html) one can utilize the JWKS specification and fetch the signing public key(s) from a uri, instead of dealing with keys, stored in the keystore file:\r\n```xml\r\n<mpJwt \r\n     id=\"myMpJwt\"\r\n     jwksUri=\"https://example.com/api/jwk\"\r\n    ...\r\n</mpJwt>\r\n```\r\nI don't think this is working in OL 18.0.0.1: If I configure this [JWKS URI](https://rhown-dev.auth0.com/.well-known/jwks.json) in my <mpJwt> configuration, i see this failure in the logs:\r\n\r\n```\r\n[4/13/18 13:55:19:352 PDT] 000006b2 com.ibm.ws.logging.internal.impl.IncidentImpl                I FFDC1015I: An FFDC Incident has been created: \"com.ibm.websphere.security.jwt.InvalidClaimException: CWWKS6029E: The JSON Web Token (JWT) cannot be validated because a signing key cannot be found. The configured signature algorithm [RS256] requires a key to validate the token. com.ibm.ws.security.jwt.internal.ConsumerImpl 189\" at ffdc_18.04.13_13.55.19.0.log\r\n[4/13/18 13:55:19:364 PDT] 000006b2 com.ibm.ws.logging.internal.impl.IncidentImpl                I FFDC1015I: An FFDC Incident has been created: \"com.ibm.websphere.security.jwt.InvalidTokenException: CWWKS6031E: The JSON Web Token (JWT) consumer [jwtUserConsumer] cannot process the token string. CWWKS6029E: The JSON Web Token (JWT) cannot be validated because a signing key cannot be found. The configured signature algorithm [RS256] requires a key to validate the token.  com.ibm.ws.security.mp.jwt.tai.TAIJwtUtils 47\" at ffdc_18.04.13_13.55.19.1.log\r\n[4/13/18 13:55:19:364 PDT] 000006b2 com.ibm.ws.security.mp.jwt.tai.TAIJwtUtils                   E CWWKS5524E: The MicroProfile JWT feature encountered an error while creating a JWT by using the [jwtUserConsumer] configuration and the token included in the request. CWWKS6031E: The JSON Web Token (JWT) consumer [jwtUserConsumer] cannot process the token string. CWWKS6029E: The JSON Web Token (JWT) cannot be validated because a signing key cannot be found. The configured signature algorithm [RS256] requires a key to validate the token. \r\n[4/13/18 13:55:19:365 PDT] 000006b2 com.ibm.ws.security.mp.jwt.tai.MicroProfileJwtTAI            E CWWKS5523E: The MicroProfile JWT feature cannot authenticate the request because a valid JWT cannot be created from the token included in the request. CWWKS5524E: The MicroProfile JWT feature encountered an error while creating a JWT by using the [jwtUserConsumer] configuration and the token included in the request. CWWKS6031E: The JSON Web Token (JWT) consumer [jwtUserConsumer] cannot process the token string. CWWKS6029E: The JSON Web Token (JWT) cannot be validated because a signing key cannot be found. The configured signature algorithm [RS256] requires a key to validate the token. \r\n[4/13/18 13:55:19:443 PDT] 000006b2 .ibm.ws.jaxrs.2.0.common:1.0.20.cl180120180309-2209(id=113)] I Setting the server's publish address to be /rest/\r\n```\r\nThere are no logs indicating any attempt to download the signing PK from the  uri.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/comments/381280919","html_url":"https://github.com/OpenLiberty/open-liberty/issues/3117#issuecomment-381280919","issue_url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3117","id":381280919,"user":{"login":"chunlongliang-ibm","id":29715913,"avatar_url":"https://avatars2.githubusercontent.com/u/29715913?v=4","gravatar_id":"","url":"https://api.github.com/users/chunlongliang-ibm","html_url":"https://github.com/chunlongliang-ibm","followers_url":"https://api.github.com/users/chunlongliang-ibm/followers","following_url":"https://api.github.com/users/chunlongliang-ibm/following{/other_user}","gists_url":"https://api.github.com/users/chunlongliang-ibm/gists{/gist_id}","starred_url":"https://api.github.com/users/chunlongliang-ibm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chunlongliang-ibm/subscriptions","organizations_url":"https://api.github.com/users/chunlongliang-ibm/orgs","repos_url":"https://api.github.com/users/chunlongliang-ibm/repos","events_url":"https://api.github.com/users/chunlongliang-ibm/events{/privacy}","received_events_url":"https://api.github.com/users/chunlongliang-ibm/received_events","type":"User","site_admin":false},"created_at":"2018-04-13T23:06:05Z","updated_at":"2018-04-13T23:06:05Z","author_association":"NONE","body":"Liberty OL as a client to make HTTPS connection to JWK. To get HTTPS working, as part of hand shaking, JWK's certificate must be in OL's trust store. If you have trace enabled, you will see ssl handshaking exception. \r\n\r\n"}}
{"actor":{"display_login":"chunlongliang-ibm"}}