VerifyJWT - fails with NullPointerException

[tcavaleiro]

Hi community,

we have built a JWT validation flow that does all the standard steps to validate a RS256 token.

LookupCache - retrieve JWKS from cache
ServiceCallout - conditional,  get from jwk_uri if no match on cache
PopulateCache - conditional, update cache 
AssignMessage - conditional, if not from cache copy to variable
VerifyJWT - fails with NullPointerException

Because we thought the issue was related with our internal flow we have made a change to use directly VerifyJWT with an URI but still fails.

When tracing, we can see the keys have been download but the policy is failing with NullPointerException.

Below logs from Message Processor

2024-11-xx aa:bb:cc,005 org:ABC env:abc-DEV api:dummyTest2 rev:10 messageid:<removed>-4286-44484-18 policy:VJ-CheckAuthToken NIOThread@3 ERROR STEPDEFINITIONS.JWT - VerifyJWTStepExecution.verifyJwt() : Exception while verifying JWT {}
java.lang.NullPointerException: null
at com.apigee.steps.jwt.verify.jwt.VerifyJWTStepExecution.verifyJwt(VerifyJWTStepExecution.java:357)
at com.apigee.steps.jwt.verify.jwt.VerifyJWTStepExecution.execute(VerifyJWTStepExecution.java:135)
(...)

Other points noticed:

- if we supply an expired JWT it will throw the expected steps.jwt.TokenExpired error

- when supplying a  valid JWT the NPE will be raised

- the JSON returned by the jwk_uri is a valid json, although we noticed the "alg" property is not been defined, can this be a mandatory field on the Apigee end? meanwhile the provider added the field but still fails

- we are using Apigee OPDK Version 4.52.00.00

Thank you.