Set Algorithm for JWK (RSA) if not set

[MichelZ]

Algorithm is not mandatory for the key material, so we set it to the same as the JWT

[MichelZ]

To elaborate on this, I have tried to use Azure AD as an OpenID Connect IdP for ES/Kibana, and I get the following error message:

[2019-04-22T08:15:25,582][DEBUG][c.a.o.s.a.BackendRegistry] [mize-es-master-1] 'org.apache.cxf.rs.security.jose.jws.JwsException: ALGORITHM_NOT_SET' extracting credentials from jwt-key-by-oidc http authenticator
org.apache.cxf.rs.security.jose.jws.JwsException: ALGORITHM_NOT_SET
        at org.apache.cxf.rs.security.jose.jws.JwsUtils.getPublicKeySignatureVerifier(JwsUtils.java:177) ~[cxf-rt-rs-security-jose-3.2.2.jar:3.2.2]
        at org.apache.cxf.rs.security.jose.jws.JwsUtils.getSignatureVerifier(JwsUtils.java:146) ~[cxf-rt-rs-security-jose-3.2.2.jar:3.2.2]
        at org.apache.cxf.rs.security.jose.jws.JwsUtils.getSignatureVerifier(JwsUtils.java:138) ~[cxf-rt-rs-security-jose-3.2.2.jar:3.2.2]

More details here: https://discuss.opendistrocommunity.dev/t/oidc-with-azure-ad-algorithm-not-set/470

I have found out that Microsoft does not use the "ALG" header on the Key Material (JWK), you can see this here: https://login.microsoftonline.com/common/discovery/keys

This makes the verify code trip, as it is expecting an ALG header.
The ALG header is completely optional, so the code should support this.

I probably haven't done it the "right" way though, so please revise as you see fit, but the code should definitely support this, and would allow to use Microsoft's Azure Active Directory as a login provider.

[MichelZ]

@floragunncom you obviously have the same issue. Dunno if Azure AD hasn't been requested much yet...

[chrisferry]

Can we get this merged in please?

[lukibahr]

+1

[MichelZ]

@NihalHarish @hardik-k-shah @prashar

[alolita]

@chrisferry assigned to @hardik-k-shah to review.

[prashar]

@MichelZ - Can you write some unit tests for this ?

[chrisferry]

@MichelZ - Can you write some unit tests for this ?

Do we really need A unit test for this? Seems wasteful. Can't we get this approved and merged in?

[Sharma-Rajat]

+1