-
-
Notifications
You must be signed in to change notification settings - Fork 521
Description
It seems id_token generation is broken with EdDSA jwks.
The create_half_hash method is called in the generate_id_token method:
authlib/authlib/oidc/core/grants/util.py
Lines 102 to 107 in c9890da
| if code: | |
| payload["c_hash"] = to_native(create_half_hash(code, alg)) | |
| access_token = token.get("access_token") | |
| if access_token: | |
| payload["at_hash"] = to_native(create_half_hash(access_token, alg)) |
However, it seems it does not support EdDSA keys:
>>> from authlib.oidc.core.util import create_half_hash
>>> assert create_half_hash("test", "RS256")
>>> assert create_half_hash("test", "EdDSA")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
AssertionErrorAfter investigation, it seems this is because authlib tries to access hashlib.shaDSA, which does not exist:
authlib/authlib/oidc/core/util.py
Lines 7 to 14 in c9890da
| def create_half_hash(s, alg): | |
| hash_type = f"sha{alg[2:]}" | |
| hash_alg = getattr(hashlib, hash_type, None) | |
| if not hash_alg: | |
| return None | |
| data_digest = hash_alg(to_bytes(s)).digest() | |
| slice_index = int(len(data_digest) / 2) | |
| return urlsafe_b64encode(data_digest[:slice_index]) |
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels