JwkSet endpoint returns empty keys

[nickmelis]

Describe the bug
After the last changes as part of [#196], I have removed the definition of CryptoKeySource bean in favour of JWKSource, as shown in the sample app:

@Bean
  public JWKSource<SecurityContext> jwkSource() {
    RSAKey rsaKey = generateRsa();
    JWKSet jwkSet = new JWKSet(rsaKey);
    return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
  }

This causes an error on the client app (which is also based on Spring Security) when it tries to validate the token:

Caused by: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
	at com.nimbusds.jwt.proc.DefaultJWTProcessor.process(DefaultJWTProcessor.java:384)
	at com.nimbusds.jwt.proc.DefaultJWTProcessor.process(DefaultJWTProcessor.java:330)
	at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.createJwt(NimbusJwtDecoder.java:144)

What causes this in the client is its inability to fetch the right public key from /oauth2/jwks (which returns an empty list), therefore making impossible to validate the validity of the token.

To Reproduce
Run the sample app provided

Expected behavior
The app should keep working as before, therefore enabling clients to validate JWT

[nickmelis]

To add to the above, the problem seems to be with the selector in the bean declaration

 return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);

When hitting /oauth2/jwks, the selector filters for public keys, which means it tries to discard every JWK inside jwkSet where jwk.isPrivate() == true
Now, clearly the key pair generated with generateRsa() has both a public and private key in it, so I can't quite understand where the issue comes from.

[florianberthe]

I reproduced the bug. It seems related to this.jwkSelector = new JWKSelector(new JWKMatcher.Builder().publicOnly(true).build()); in NimbusJwkSetEndpointFilter.

[jgrandja]

Thanks for the report @nickmelis ! This is now fixed via b7996e2.

@florianberthe You are correct. The issue was with the JWKMatcher.

[nickmelis]

Thanks for finding and implementing the fix @florianberthe @jgrandja, I can confirm it works a treat now :)