title: What part of the key object do I pass into `openssl_verify` to verify a Google signed JWT?
body: <p>I'm trying to implement a federated login system with Google and OpenID Connect, and I'm stuck verifying and parsing the JWT id token I get back from Google. I'm following <a href="https://developers.google.com/accounts/docs/OAuth2Login#validatinganidtoken" rel="noreferrer">Google's documentation</a> here.</p>
  
  <p>Taking the advise of the docs, I'm trying to use an existing JWT library. The most popular PHP version on GitHub seems to be <a href="https://github.com/firebase/php-jwt" rel="noreferrer">PHP_JWT</a>. The problem appears to be in the format of the JWK keys.</p>
  
  <p>Google's docs, linked above, say to get the keys from the <code>jwks_uri</code> endpoint as shown in their discovery doc. That endpoint returns the following:</p>
  
  <pre><code>{
   "keys": [
    {
     "kty": "RSA",
     "alg": "RS256",
     "use": "sig",
     "kid": "1771931eb0eb64eb97733e857685be153e079bb9",
     "n": "AMNFQMNJw/EVwrYsyPTnEHWkaPinPb4ngc/SqD701aisFhbU9/wWoKADeFtwfBcWl1qjzIqhPorQElB+2mtiqUh3Qtaazt1x5wA9XnJDe6kjtMGm9nNLMilSVNBilAE8GIdbciMycISfOfL0WRaJrqpNxewNEVZjuYiGzOWahiDP",
     "e": "AQAB"
    },
    {
     "kty": "RSA",
     "alg": "RS256",
     "use": "sig",
     "kid": "7b3bc600209875d3c42ae277a0d018d1d21986ec",
     "n": "AN2UvG5+hNEMIPIbnpPm+JQi6LFWXBPzg3Ltb3xkVmSTjVaCFWppw/ZYRBgpToGKZP9XJstlOE88SDUFSMZIkIqtLpnUqmZax2Zc2gjEB9PhmHSH3/tTmtZ1U0X6V+crqitZ2uc3NV78vCn9/s+WuPwk/gfKBG8Cirb0fgLmsPd9",
     "e": "AQAB"
    }
   ]
  }
  </code></pre>
  
  <p>Looking at <a href="https://github.com/firebase/php-jwt/blob/master/Authentication/JWT.php#L57" rel="noreferrer">the source</a> for the JWT class's <code>decode</code> and <code>verify</code> methods, it seems like the <code>$keys</code> parameter can be an array, but they expect the array keys to be the <code>kid</code> and the array values to be: <code>@param string|resource $key for HS*, a string key works. for RS*, must be a resource of an openssl public key</code>. It's simple enough to pull out the <code>kid</code> properties and use them as array keys, but what should be used as the array values?</p>
  
  <p>From Google's JWKs document, it looks like we're using <code>RS*</code>, but I have no idea what part of the key object is the <code>resource of an openssl public key</code>. I've tried using the entire stdClass object and just the <code>n</code> string, but both fail at the <a href="https://github.com/firebase/php-jwt/blob/master/Authentication/JWT.php#L152" rel="noreferrer"><code>openssl_verify</code></a> step. That function emits a notice saying: "Warning: openssl_verify(): supplied key param cannot be coerced into a public key".</p>
  
  <p>So, obviously, I'm passing in the wrong key, but what is the right key?</p>
  
  <p><a href="https://github.com/googleplus/gplus-verifytoken-php" rel="noreferrer">Google's library</a> for this seems to use a <a href="https://github.com/googleplus/gplus-verifytoken-php/blob/89a459fc4f995b4b2a4c0e0a8d52549d5e4b9035/google-api-php-client/src/auth/Google_OAuth2.php#L45" rel="noreferrer">different endpoint</a> to get the keys. That endpoint seems to return an array of certs. Do I need to use something like that instead? If so, why would the docs tell you to use the <code>jwks_uri</code> endpoint?</p>