From 27dd5fc0aeb6da88fa6227dc96ccce4c1c408a2c Mon Sep 17 00:00:00 2001
From: mdecimus <11444311+mdecimus@users.noreply.github.com>
Date: Mon, 16 Mar 2026 14:16:35 +0100
Subject: [PATCH] OIDC: Do not include symmetric keys in JWT keys

---
 crates/common/src/auth/oauth/config.rs | 39 +++++++++++++-------------
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/crates/common/src/auth/oauth/config.rs b/crates/common/src/auth/oauth/config.rs
index 58c7ebb5..86f8888a 100644
--- a/crates/common/src/auth/oauth/config.rs
+++ b/crates/common/src/auth/oauth/config.rs
@@ -83,13 +83,7 @@ impl OAuthConfig {
             SignatureAlgorithm::None
             | SignatureAlgorithm::HS256
             | SignatureAlgorithm::HS384
-            | SignatureAlgorithm::HS512 => (
-                Secret::Bytes(signature_key.as_bytes().to_vec()),
-                AlgorithmParameters::OctetKey(OctetKeyParameters {
-                    key_type: OctetKeyType::Octet,
-                    value: signature_key.as_bytes().to_vec(),
-                }),
-            ),
+            | SignatureAlgorithm::HS512 => (Secret::Bytes(signature_key.as_bytes().to_vec()), None),
             SignatureAlgorithm::RS256
             | SignatureAlgorithm::RS384
             | SignatureAlgorithm::RS512
@@ -100,13 +94,15 @@ impl OAuthConfig {
                 .map_err(|err| {
                     bp.build_error(ObjectType::OidcProvider.singleton(), err);
                 })
+                .map(|(secret, alg)| (secret, Some(alg)))
                 .unwrap_or_else(|_| {
                     (
                         Secret::Bytes(rand_key.clone()),
                         AlgorithmParameters::OctetKey(OctetKeyParameters {
                             key_type: OctetKeyType::Octet,
                             value: rand_key,
-                        }),
+                        })
+                        .into(),
                     )
                 }),
             SignatureAlgorithm::ES256 | SignatureAlgorithm::ES384 | SignatureAlgorithm::ES512 => {
@@ -115,13 +111,15 @@ impl OAuthConfig {
                     .map_err(|err| {
                         bp.build_error(ObjectType::OidcProvider.singleton(), err);
                     })
+                    .map(|(secret, alg)| (secret, Some(alg)))
                     .unwrap_or_else(|_| {
                         (
                             Secret::Bytes(rand_key.clone()),
                             AlgorithmParameters::OctetKey(OctetKeyParameters {
                                 key_type: OctetKeyType::Octet,
                                 value: rand_key,
-                            }),
+                            })
+                            .into(),
                         )
                     })
             }
@@ -130,16 +128,19 @@ impl OAuthConfig {
         let oidc_jwks = Resource {
             content_type: "application/json".into(),
             contents: serde_json::to_string(&JWKSet {
-                keys: vec![JWK {
-                    common: CommonParameters {
-                        public_key_use: PublicKeyUse::Signature.into(),
-                        algorithm: Algorithm::Signature(oidc_signature_algorithm).into(),
-                        key_id: "default".to_string().into(),
-                        ..Default::default()
-                    },
-                    algorithm,
-                    additional: (),
-                }],
+                keys: algorithm
+                    .into_iter()
+                    .map(|algorithm| JWK {
+                        common: CommonParameters {
+                            public_key_use: PublicKeyUse::Signature.into(),
+                            algorithm: Algorithm::Signature(oidc_signature_algorithm).into(),
+                            key_id: "default".to_string().into(),
+                            ..Default::default()
+                        },
+                        algorithm,
+                        additional: (),
+                    })
+                    .collect(),
             })
             .unwrap_or_default()
             .into_bytes(),