support use of Elliptic Curve prime256v1 keys for private_key_jwt

(ES256) token endpoint and introspection endpoint authentication;
closes #1336; bump to 2.4.17.2dev

Signed-off-by: Hans Zandbelt <[email protected]>

Author: zandbelt

ChangeLog

@@ -1,3 +1,8 @@
+07/11/2025
+- support use of Elliptic Curve prime256v1 keys for private_key_jwt (ES256) token endpoint
+  and introspection endpoint authentication; closes #1336
+- bump to 2.4.17.2dev
+
 06/25/2025
 - allow to suppress warnings about (individual) X-Forwarded headers; see #1333
   through environment variable OIDC_CHECK_X_FORWARDED_HDR_LOG_DISABLE, e.g.:

configure.ac

@@ -1,4 +1,4 @@
-AC_INIT([mod_auth_openidc],[2.4.17.1],[[email protected]])
+AC_INIT([mod_auth_openidc],[2.4.17.2dev],[[email protected]])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 

src/proto/auth.c

@@ -191,14 +191,12 @@ static apr_byte_t oidc_proto_endpoint_auth_private_key_jwt(request_rec *r, oidc_
 		return FALSE;
 
 	if ((client_keys != NULL) && (client_keys->nelts > 0)) {
-		jwk = oidc_util_key_list_first(client_keys, CJOSE_JWK_KTY_RSA, OIDC_JOSE_JWK_SIG_STR);
+		jwk = oidc_util_key_list_first(client_keys, -1, OIDC_JOSE_JWK_SIG_STR);
 		if (jwk && jwk->x5t)
 			jwt->header.x5t = apr_pstrdup(r->pool, jwk->x5t);
 	} else if ((oidc_cfg_private_keys_get(cfg) != NULL) && (oidc_cfg_private_keys_get(cfg)->nelts > 0)) {
-		jwk =
-		    oidc_util_key_list_first(oidc_cfg_private_keys_get(cfg), CJOSE_JWK_KTY_RSA, OIDC_JOSE_JWK_SIG_STR);
-		jwk_pub =
-		    oidc_util_key_list_first(oidc_cfg_public_keys_get(cfg), CJOSE_JWK_KTY_RSA, OIDC_JOSE_JWK_SIG_STR);
+		jwk = oidc_util_key_list_first(oidc_cfg_private_keys_get(cfg), -1, OIDC_JOSE_JWK_SIG_STR);
+		jwk_pub = oidc_util_key_list_first(oidc_cfg_public_keys_get(cfg), -1, OIDC_JOSE_JWK_SIG_STR);
 		if (jwk_pub && jwk_pub->x5t)
 			// populate x5t; at least required for Microsoft Entra ID / Azure AD
 			jwt->header.x5t = apr_pstrdup(r->pool, jwk_pub->x5t);
@@ -212,7 +210,8 @@ static apr_byte_t oidc_proto_endpoint_auth_private_key_jwt(request_rec *r, oidc_
 	}
 
 	jwt->header.kid = apr_pstrdup(r->pool, jwk->kid);
-	jwt->header.alg = apr_pstrdup(r->pool, CJOSE_HDR_ALG_RS256);
+	jwt->header.alg =
+	    apr_pstrdup(r->pool, jwk->kty == CJOSE_JWK_KTY_EC ? CJOSE_HDR_ALG_ES256 : CJOSE_HDR_ALG_RS256);
 
 	oidc_proto_jwt_sign_and_add(r, params, jwt, jwk);