UNCLASSIFIED - NO CUI

Skip to content

Authservice cannot use JWKS URI when using the SSO IdP uses a custom CA

Bug

Description

Thanks to @kevin.wilder for the help in discovering / triaging this.

When you are using SSO with an IdP that has a custom CA, Authservice uses the value of sso.certificateAuthority.cert to communicate with the IdP. This works as expected in most cases. However, specifically when using jwksUri, Authservice does not load this CA cert and fails to grab the JWKS data. This occurs even if you specify jwks.

BigBang Version

This applies to every version of Big Bang if using jwksUri, but only after 1.52.0 if using hardcoded jwks.