Support OIDC ES256 JWS Signing Algorithm

XMLWordPrintableJSON

    • Type: Task
    • Resolution: Fixed
    • Priority: Major - P3
    • 8.3.0-rc0
    • Affects Version/s: None
    • Component/s: Security
    • None
    • Server Security
    • Fully Compatible
    • Server Security 2025-07-20, Server Security 2025-08-01, Server Security 2025-08-15, Server Security 2025-08-29, Server Security 2025-09-12
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      The Server currently supports RS and PS family of JWS signing algorithms. This ticket will add ES - in particular, ES256. This signature is supported by GCP.

      1. Implement ES256 signature verification for the server OIDC SASL mechanism.
      2. Implement unit tests, and JS tests, to validate that valid ES256 signed tokens are accepted by the server, and that invalid ES tokens are rejected.
      3. Manually validate this capability against GCP IdPs that provide ES256 signed tokens for workload identity federation. (see https://cloud.google.com/iam/docs/reference/sts/rest/v1/TopLevel/token as a starting point)

        1.
        		 Support ES256/384 Signature verification in SSL Manager SERVER-108584 Sub-task Closed Chye Lin Chee 8.3.0-rc0
        2.
        		 Write JS Tests for tokens with ES256/384 signatures SERVER-108915 Sub-task Closed Chye Lin Chee 8.3.0-rc0
        3.
        		 Fix build failure for older OpenSSL versions SERVER-109272 Sub-task Closed Chye Lin Chee 8.3.0-rc0

            Assignee:
            Chye Lin Chee
            Reporter:
            Adam Rayner
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: