Id token encryption problem with OpenID Connect identity provider

RE: Id token encryption problem with OpenID Connect identity provider

2020-01-30T11:44:38Z

I believe JWE is not supported on Liferay side yet. Only JWS.

RE: Id token encryption problem with OpenID Connect identity provider

2020-01-25T13:21:24Z

I am also seeing this issue when trying to configure Liferay v7.2.1 as OIDC client to Apereo CAS v6.1 as OIDC provider. "Unable to instantiate token validator: Missing required ID token JWE encryption method for RSA1_5". In Apereo CAS, there is a service config for "encryptIdToken": false, but this doesn't make a difference to Liferay.

RE: Id token encryption problem with OpenID Connect identity provider

2018-12-12T14:37:02Z

Hi Teddy,

The message given came from the nimbusds library where the OIDCClientInformation given by liferay do not provide the IDTokenJWEEnc expected.

In order to be able to make it working, you need to address two points : override the OpenIdConnectMetadataFactory to add the IDTokenJWEEnc when the OIDCClientMetadata is build and second point, you need to override the OpenIDConnect configuration to be able to add this new parameter from the UI.

Best regards,

David.

RE: Id token encryption problem with OpenID Connect identity provider

2018-11-23T13:49:28Z

Please, could you help me ?

Id token encryption problem with OpenID Connect identity provider

2018-11-14T16:04:38Z

Hello,

I'm trying to use Gluu as a OpenID Connect identity provider for Liferay. I ran into the following error: "Caused by: com.nimbusds.oauth2.sdk.GeneralException: Missing required ID token JWE encryption method for RSA1_5". It leads me to believe that Liferay is expecting the id token to be encrypted although it's not required by the OpenID Connect standard. I tried different encryption algorithms settings inside of Gluu. But it seems like I need a Liferay plublic encryption key (JWKS) or the URI where those keys can be accessed (JWKS URI) because without it I'm getting another error "NullPointerException: null".

Thanks for the help.