Sorry about that.
There is a logic error in the key selection for ES256, in Apigee EDGE (internal reference b/195619555). This bug has been fixed in hybrid and X, but the fix apparently has not yet been released in Apigee EDGE. Basically, the error is: the policy fails to select a matching key, if the kty is EC, and the "use" field is present in the JWK. (Don't ask)
So the workaround is to eliminate the "use" field in the JWK. If you don't control the JWK you cannot do it directly. So a possible way to do it is to introduce a proxy between your policy and the JWKS endpoint, which manipulates the JWKS payload and strips out the "use" field. You would probably use a JavaScript callout to do that payload modification. It would look like this:
// modify the payload of a JWKS to remove the "use" fields in each EC key
var payload = JSON.parse(context.getVariable('response.content'));
payload.keys.forEach(function(jwk) {
if (jwk.use && jwk.kty == 'EC') { delete jwk.use; }
});
context.setVariable('response.content', JSON.stringify(payload));
Another way to solve the problem is to use a ServiceCallout within your proxy to retrieve the JWKS, and then do the same modification, and refer to the modified JWKS in the VerifyJWT policy (instead of pointing to a JWKS uri). But you'd want to cache the result of that ServiceCallout, which means 6-7 policies. It seems easier to me, to just wrap the modification of the JWKS into a separate proxy. When VerifyJWT retrieves a JWKS from a URI, it automatically caches it, so you wouldn't need to do it if you used the proxy-the-JWKS-endpoint approach.
I think you can probably search here on community to find prior reports of this problem.... and maybe see what other people did to solve it.
LinkedIn
Twitter
