-
|
As I mentioned in #622, I'm having a little bit of trouble getting SSH user certs with step-ca set up to authenticate with my LemonLDAP::NG instance. I started with a Raspberry Pi-based "tiny CA" following the instructions at https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/, and using (and adding to) the discussion at #400, should have it set up to issue SSH certs as well. But when I try to log in and get a user cert, it isn't working, and I'm not sure why. Here's the session log on my client system: The default web browser was in fact opened, it presented a login page, I entered username/password, and it gave me a "success" page. Here's the relevant part of the system log on the CA: Not sure where to go from here--any thoughts? |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 3 replies
-
|
I've found https://jwt.io/, and used it to decode the token in the response. It seems to decode without error, and its payload reads: The If I enable debug mode ( If I change the ID token signature algorithm in LemonLDAP::NG from HS512 to RS256, jwt.io can verify the signature of the resulting token, but I'm seeing the same error in the log: |
Beta Was this translation helpful? Give feedback.
-
|
The error that you see in the last line, The JWT header that you can see using |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the reply. In the first instance, the token signature algorithm was set to its default for LLNG, HS512, and in that case, the header didn't have a After setting the signature algorithm to RS256 instead (log output in my last comment above), jwt.io does validate the signature, and there is a
But the error remains: |
Beta Was this translation helpful? Give feedback.
-
|
step-ca caches the keys and refreshes them every 12h unless there's a But if you restarted step-ca I don't know what is going on. It would be helpful if you can edit the code and add here certificates/authority/provisioner/oidc.go Lines 279 to 284 in bc14341 Something like: for _, key := range keys {
if err := jwt.Claims(key, &claims); err == nil {
found = true
break
} else {
log.Println(err)
}
}and importing |
Beta Was this translation helpful? Give feedback.
-
I can't honestly say how much time passed between my last attempt with HS512 and my first attempt with RS256--it may have been less than 12h. I just tried again, without having made any changes to any of the configuration since the last attempt, and it does now work. |
Beta Was this translation helpful? Give feedback.
The error that you see in the last line,
... cannot validate oidc token, only happens when step-ca cannot find any public key that validates the signature of the token. The keys are obtained from the endpoint of the property namedjwks_uri; for example, in Google's OpenID configuration the keys are the ones at https://www.googleapis.com/oauth2/v3/certsThe JWT header that you can see using
echo your-token | step crypto jwt inspect --insecureshould have a property namedkidwith the key used to sign your token for example"kid": "b6f8d55da534ea91cb2cb00e1af4e8e0cdeca93d"matches the first key in https://www.googleapis.com/oauth2/v3/certs