{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/go-oidc/issues/140","repository_url":"https://api.github.com/repos/coreos/go-oidc","labels_url":"https://api.github.com/repos/coreos/go-oidc/issues/140/labels{/name}","comments_url":"https://api.github.com/repos/coreos/go-oidc/issues/140/comments","events_url":"https://api.github.com/repos/coreos/go-oidc/issues/140/events","html_url":"https://github.com/coreos/go-oidc/issues/140","id":221881682,"number":140,"title":"Failure on missing key id","user":{"login":"Grillz","id":5533189,"avatar_url":"https://avatars0.githubusercontent.com/u/5533189?v=3","gravatar_id":"","url":"https://api.github.com/users/Grillz","html_url":"https://github.com/Grillz","followers_url":"https://api.github.com/users/Grillz/followers","following_url":"https://api.github.com/users/Grillz/following{/other_user}","gists_url":"https://api.github.com/users/Grillz/gists{/gist_id}","starred_url":"https://api.github.com/users/Grillz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Grillz/subscriptions","organizations_url":"https://api.github.com/users/Grillz/orgs","repos_url":"https://api.github.com/users/Grillz/repos","events_url":"https://api.github.com/users/Grillz/events{/privacy}","received_events_url":"https://api.github.com/users/Grillz/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2017-04-14T20:09:13Z","updated_at":"2017-04-26T18:11:57Z","closed_at":"2017-04-26T18:11:57Z","body":"Hey, I'm trying to use this library to connect to https://github.com/ory/hydra. Everything works fine up until the final signature verification at https://github.com/coreos/go-oidc/blob/master/verify.go#L185 . The JWT headers that Hydra provides do not have `kid` as a part of them. Here is a comparison:\r\n\r\nHydra   \r\n```\r\n{\r\n  \"alg\": \"RS256\",\r\n  \"typ\": \"JWT\"\r\n}\r\n```\r\nGoogle   \r\n```\r\n{\r\n  \"alg\": \"RS256\",\r\n  \"kid\": \"fb41c2409340c77eb259a66c9f79809649a62971\"\r\n}\r\n```\r\n\r\nNote, the RFC on JWT's doesn't specify a `kid` parameter https://tools.ietf.org/html/rfc7519#section-5\r\n\r\nWhen the verification step happens it looks for the `KeyId` that was parsed by go-jose, because its nil it fails https://github.com/coreos/go-oidc/blob/master/verify.go#L193.\r\n\r\nI'd be happy to rewrite this algorithm 👍 "},"comment":{"url":"https://api.github.com/repos/coreos/go-oidc/issues/comments/297495751","html_url":"https://github.com/coreos/go-oidc/issues/140#issuecomment-297495751","issue_url":"https://api.github.com/repos/coreos/go-oidc/issues/140","id":297495751,"user":{"login":"Grillz","id":5533189,"avatar_url":"https://avatars0.githubusercontent.com/u/5533189?v=3","gravatar_id":"","url":"https://api.github.com/users/Grillz","html_url":"https://github.com/Grillz","followers_url":"https://api.github.com/users/Grillz/followers","following_url":"https://api.github.com/users/Grillz/following{/other_user}","gists_url":"https://api.github.com/users/Grillz/gists{/gist_id}","starred_url":"https://api.github.com/users/Grillz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Grillz/subscriptions","organizations_url":"https://api.github.com/users/Grillz/orgs","repos_url":"https://api.github.com/users/Grillz/repos","events_url":"https://api.github.com/users/Grillz/events{/privacy}","received_events_url":"https://api.github.com/users/Grillz/received_events","type":"User","site_admin":false},"created_at":"2017-04-26T18:11:57Z","updated_at":"2017-04-26T18:11:57Z","body":"Ah I missed that in the OIDC RFC, was focused on the JWT Signing RFC, sorry about the running in circles, I will correct on Hydra's end then. Thanks"}}
{"actor":{"display_login":"Grillz"}}