Support configurable signing algorithms about doorkeeper-openid_connect

[toupeira]

Hi there @gigr! Yes this change would be very welcome and your plan sounds about right, though I haven't yet looked into the exact requirements for the other algorithms. But we use json-jwt which supports most of them, so it really should just be a matter of figuring out how to configure the necessary keys/secrets.

We also need to make sure DiscoveryController#keys_response includes the required parameters for the JWKS, see RFC 7517.

Actually I just realized we're not using jws_public_key, since the public key can be extracted from the private one. So maybe it would be possible to replace the jws_* settings with a signing_key setting which would be responsible for returning an object that can be passed to JSON::JWK.new:

Doorkeeper::OpenidConnect.configure do
  signing_key do
    OpenSSL::PKey.read(File.read(ENV['JWS_PRIVATE_KEY'])
  end
end

And then maybe we can deduce the signing_algorithm value from the class and attributes? If not we could just add it as an explicit setting, as you suggest.

[gigr]

Awesome! The idea of adding a signing_key makes sense as well. I'll explore that as an option in the PR. I'll be cognizant of the fact that adding a new configuration option for configuring the same thing could break backwards compatibility as well.

I could see this being a few PRs as opposed to one larger one. Do you want me to break it up or would you rather a single, feature-complete PR?

[toupeira]

I think we should be fine if we keep jws_private_key, log a deprecation warning there, and delegate to the new signing_key. I deprecated jws_public_key now in 8494eed.

Feel free to submit smaller PRs if you want, but a single one is perfectly fine as well. I don't plan on making a lot of changes in the near future, so you should be safe from merge conflicts ;-)

[gigr]

Okay! I'll ping you when I have something to show. Thanks so much!

[travisofthenorth]

@gigr is this still on your radar? I would also love to get support for additional algorithms.

[gigr]

Not as much. We've found that using the public/private keypair is actually a better solution for our needs. RSA256 is fine as well.

[travisofthenorth]

@toupeira is this PR sufficient? #34

[travisofthenorth]

@toupeira any idea when you might publish a new version of the gem?

[toupeira]

@travisofthenorth very soon, waiting for #36 to get in as well.