mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 21:52:54 +00:00
b558a1f79f
# Which Problems Are Solved Currently ZITADEL only allows the use of RSA public keys for machine user authentication (jwt-bearer grant), including for system API users. Attempting to use ECDSA (e.g. P-256) or ED25519 keys results in `Errors.Internal` because `BytesToPublicKey` performs an `ifc.(*rsa.PublicKey)` type assertion that returns `(nil, nil)` for non-RSA keys, which then causes a nil key panic in go-jose during JWT verification. This is the same fix as #8433 (by @livio-a), rebased onto current `main`. # How the Problems Are Solved - `BytesToPublicKey` now returns `crypto.PublicKey` (the standard library interface) instead of `*rsa.PublicKey` - A type switch validates the parsed key is one of `*rsa.PublicKey`, `*ecdsa.PublicKey`, or `ed25519.PublicKey` - A new `ErrNoPublicKey` sentinel error is returned for unsupported key types instead of silently returning nil - Callers in `system_token.go` and `query/key.go` are updated to use the generic `crypto.PublicKey` interface # Additional Changes None # Additional Context Duplicate of #8433 which has been open since August 2024. We hit this bug while implementing OIDC bootstrap for an SGX enclave that generates ECDSA P-256 keys at runtime -- the `AddKey` API accepts the ECDSA SPKI PEM fine, but the subsequent `jwt-bearer` token exchange fails with `Errors.Internal` due to the nil key. --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Wim Van Laer <[email protected]>