Skip to content

fix: federation jwks for signing EC#539

Open
peppelinux wants to merge 3 commits into
mainfrom
fedjwks
Open

fix: federation jwks for signing EC#539
peppelinux wants to merge 3 commits into
mainfrom
fedjwks

Conversation

@peppelinux

Copy link
Copy Markdown
Member

This pull request updates the handling of JWKS (JSON Web Key Sets) for signing and verifying JWTs in the OpenID4VCI metadata endpoint. The main change is to use federation JWKS exclusively for both signing and verification, instead of using a separate metadata JWKS. The tests have also been updated to reflect this logic and to ensure correct signature verification.

Key changes:

Metadata endpoint logic changes:

  • The metadata_jwks field has been removed from the MetadataHandler class. Now, only federation_jwks is used for signing entity statements. (pyeudiw/satosa/frontends/openid4vci/endpoints/metadata_endpoint.py)
  • In the entity_configuration method, the signing key and kid are now taken from federation_jwks, and the JWSHelper is initialized with a single JWK (not a list). (pyeudiw/satosa/frontends/openid4vci/endpoints/metadata_endpoint.py)

Test updates:

  • Introduced MOCK_FEDERATION_JWKS_CONFIG and updated the test configuration to use it for federation keys, separating it from MOCK_METADATA_JWKS_CONFIG. (pyeudiw/tests/satosa/frontends/openid4vci/mock_openid4vci.py)
  • Updated tests to check that JWTs are signed with the federation key, and added negative tests to ensure that verification with the metadata key fails. (pyeudiw/tests/satosa/frontends/openid4vci/endpoints/test_metadata_endpoint.py)
  • Added missing imports for JWK, JWSHelper, and JWSVerificationError in the test file. (pyeudiw/tests/satosa/frontends/openid4vci/endpoints/test_metadata_endpoint.py)
  • Updated test fixtures and references to use MOCK_FEDERATION_JWKS_CONFIG where appropriate. (pyeudiw/tests/satosa/frontends/openid4vci/endpoints/test_metadata_endpoint.py)

@peppelinux peppelinux requested a review from manpace June 24, 2026 06:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant