communityhelp wantedtype:enhancement
倉庫指標
- 星標
- (13,071 顆星)
- PR 合併指標
- (平均合併 24天 6小時) (30 天內合併 30 個 PR)
描述
Please confirm the following
- I agree to follow this project's code of conduct.
- I have checked the current issues for duplicates.
- I understand that AWX is open source software provided for free and that I might not receive a timely response.
Feature type
New Feature
Feature Summary
Logging in using OIDC is successful when RS256 is set on the IDP (keycloak in my case), but unsuccessful when PS256 or EdDSA is set.
"Use EdDSA where possible and use ECDSA when it is not. If you are forced to use RSA, prefer RSASSA-PSS [PS256] over RSASSA-PKCS1-v1_5 [RS256]" (quoted from “JWTs: Which Signing Algorithm Should I Use?”).
Select the relevant components
- UI
- API
- Docs
- Collection
- CLI
- Other
Steps to reproduce
- Set PS256 or EdDSA as the signature algorithm on the IDP side such as keycloak
- configure OIDC settings on AWX pointing to that IDP
- login with OIDC
Current results
Login is unsuccessful
Sugested feature result
stronger security
Additional information
- OpenBanking has already made the transition to PS256 since 03/2019
- Australian infosec has a requirement for PS256 since 2019