Validate signature? about jwt-cli

[cben]

Is there a direct relationship between iss field and URL where issuer's jwks can be fetched? 🙏
Apparently not. ☹️

• with symmetric crypto, the key to verify is secret, it wouldn't be published anywhere.
• with asymmetric crypto, I found a few conventions but no standard.
  • Some use https://DOMAIN//.well-known/jwks.json but not everyone.
  • I have a Keycloak-issued token with "iss": "https://sso.redhat.com/auth/realms/redhat-external". Hitting that URL actually returns JSON with an apparently unrelated "public_key" field and a hint "token-service": "https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect" but that one is 404, the correct jwks url is https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/certs.
    So possibly protocol/openid-connect/certs is another convention of OIDC? Or maybe it's a sub-convention of specifically Keycloak? 🤷‍♂️

[troyharvey]

@cben Thanks for raising this issue. What are your thoughts on how we could add support for this?

For symmetric crypto, we could potentially add a --verify flag that would prompt for the secret?

Thanks for the encouragement. I know it's a tiny script, but there have been some great PRs to this little repo and I'm still actively using it.

[troyharvey]

Shout to @bharkreader for adding this! @cben Now you can just add --secret=yourSigningSecret as an argument.