JWT invalid signature using RS256 algorithm

Question

JWT invalid signature using RS256 algorithm

426 views Asked by theimpatientcoder At 02 October 2023 at 05:25

I was facing problem while generating OAuth2.0 access token using JWT token validation for Azure AD. I am sure that I added the correct certificate to my Azure application. But no matter what, I am facing the same issue. To get to the root of the problem, I wrote a simple program locally to make sure that jwt sign verification works for my certificate and to my surprise, it is not.

Here is the code snippet that I have written:

import crypto from 'crypto';
import fs from 'node:fs';
import jwt from "jsonwebtoken";

function verifySign() {

    let certificatePaths = {
      "validPublicCert" : '/Users/<my-path>/certs/certificate.pem',
      "validPrivateKey" : '/Users/<my-path>/certs/privateKey.pem',
      "failingPublicCert" : '/Users/<my-path>/certs/failing-public.pem',
      "failingPrivateKey" : '/Users/<my-path>/certs/failing-prv-key.key'
    };


    // read and create public certificate
    let publicCertificateBuffer = Buffer.from(fs.readFileSync(certificatePaths.failingPublicCert, 'utf8'));
    let x509publicCert = new crypto.X509Certificate(publicCertificateBuffer);

    // base64 encode sha1 hash of certificate
    let sha = crypto.createHash("SHA1");
    sha.update(x509publicCert.raw);
    let encodedCertificate = sha.digest('base64url');
    console.log("Encoded base64 public certificate is: " + encodedCertificate);

    // prepare jwt headers
    let jwtHeaders = {
        'x5t': encodedCertificate,
        'alg' : 'RS256',
        'typ' : 'JWT'
    };

    // prepare jwt payload
    const now = Math.floor(Date.now() / 1000);
    const expiresIn = now + 3 * 60; 
    let jwtPayload = {
        "iss": "d2057bd6-1560-4b16-9988-790e1f698d9b",
        "aud": "https://login.microsoftonline.com/<my-azure-ad-tenant-domain>/oauth2/v2.0/token",
        "sub": "d2057bd6-1560-4b16-9988-790e1f698d9b",
        "x5t": encodedCertificate,
        "typ": "JWT",
        "alg": "RS256",
        "exp" : expiresIn,
        "iat" : now,
        "nbf": now
      }

      // read encrypted private key and fetch/ build private key from it
      let encryptedPrivateKeyBuffer = fs.readFileSync(certificatePaths.failingPrivateKey, 'utf8');
      let encryptedKeyPassPhrase = '<my pass phrase>';
      let encryptedKey = crypto.createPrivateKey({
        key: encryptedPrivateKeyBuffer, 
        passphrase: encryptedKeyPassPhrase
      });
      let decryptedKey = encryptedKey.export({
        format: 'pem',
        type: 'pkcs1'
    });


    let assertion = jwt.sign(jwtPayload, decryptedKey, {
      algorithm: "RS256",
      header: jwtHeaders
  });

  console.log("JWT assertion created after signing: " + assertion);

  try {
    jwt.verify(assertion, publicCertificateBuffer);
  }catch(error: any) {
    console.log(error);
  }
  
}

verifySign();

Note: For valid certificates, the verification is successful locally and I am able to generate the access token from Azure AD. For failing certificates, both the scenarios are failing.

Important: When I tried using Java, (bouncycastle and jose4j) both the certificate work fine. Is there anything that I am missing while implementing using typescript?

Valid public key

Valid private key:

-----BEGIN ENCRYPTED PRIVATE KEY-----
MII
<Remaining - Key>............
EUF7uoapGpNxXMFcqU18OQ==
-----END ENCRYPTED PRIVATE KEY-----

Failing public key:

Failing Private Key

As we can see that there is difference in the format of the keys. Since I am no expert in crypto or jwt as well, I am not able to figure out what the problem is

Thanks in advance!

Original Q&A

TechQA.

JWT invalid signature using RS256 algorithm

There are 0 answers

Related Questions in TYPESCRIPT

Related Questions in JWT

Related Questions in CRYPTOJS

Related Questions in RS256

Popular Questions

Popular Tags

Trending Questions