ECDSA (ES256) support issues in OIDC module (JWK generation and token verification)

[Kojiro-Goto]

Hi,

I am currently working with the SimpleSAMLphp OIDC module and trying to use ECDSA (ES256) for signing tokens instead of RSA.

I encountered multiple issues that seem to indicate incomplete or inconsistent support for ECDSA.

---

1. JWK generation issue

In JsonWebKeySetService::prepareProtocolJwkSet(), the implementation uses:

JWKFactory::createFromKeyFile($certificatePath, ...)

However, $certificatePath points to an X.509 certificate file (.crt), not a private key.

According to the JWT Framework documentation, createFromKeyFile() expects a key file, while certificates should be loaded using:

JWKFactory::createFromCertificateFile()

This mismatch causes failures when using ECDSA certificates, while RSA may work by coincidence.

---

2. Access token verification issue

In BearerTokenValidator, the signer is hardcoded to RSA:

use Lcobucci\JWT\Signer\Rsa\Sha256;

Configuration::forSymmetricSigner(...)

This causes ES256 tokens to fail verification with:

Access token could not be verified

The validator should dynamically select the signer based on the token's alg header (e.g., ES256 vs RS256), and use forAsymmetricSigner().

---

3. Expected behavior

• The module should support both RS256 and ES256
• JWK generation should correctly use certificate-based loading
• Token verification should dynamically select the correct signer

---

4. Questions

1. Is ECDSA (ES256) officially supported by this module?
2. If yes, what is the correct way to configure keys and certificates?
3. Should certificates be combined with private keys, or kept separate?
4. Is there a recommended key generation procedure?

---

5. Suggested fixes

• Replace createFromKeyFile() with createFromCertificateFile() when loading certificates
• Refactor BearerTokenValidator to support multiple algorithms (RS256, ES256)

---

Any guidance would be greatly appreciated.

Thanks!

[cicnavi]

Hi,
the support for defining multiple signing keys, with different signing algos was prepared in v7 of the module (dedicated branch which is Work-In-Progress). Sample docs regarding the configuration for the new implementation: https://github.com/simplesamlphp/simplesamlphp-module-oidc/blob/wip-version-7/docs/2-oidc-installation.md. In config template file this is also explained a bit more: https://github.com/simplesamlphp/simplesamlphp-module-oidc/blob/wip-version-7/config/module_oidc.php.dist.

There are still some things that I would like to do before releasing the v7 of the module, however not sure when this will happen. If you want, you can try with branch wip-version-7. I try to make it functional as I new stuff to it. You can also check changelog where this new capability is mentioned: https://github.com/simplesamlphp/simplesamlphp-module-oidc/blob/wip-version-7/docs/6-oidc-upgrade.md.

I'll leave this issue open until v7 is published.