开启nonce后pac4j刷新过期OpenID令牌抛出异常求助

复现环境 #

• pac4j版本：5.7.7、6.0.6
• OpenID提供商：Keycloak、AWS Cognito
• 触发条件：配置客户端使用nonce时，首次认证获取令牌正常，令牌过期后执行刷新操作

抛出异常 #

com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
 at PluginClassLoader for oic-auth//com.nimbusds.jwt.proc.DefaultJWTProcessor.process(DefaultJWTProcessor.java:357)
 at PluginClassLoader for oic-auth//com.nimbusds.openid.connect.sdk.validators.IDTokenValidator.validate(IDTokenValidator.java:321)
 at PluginClassLoader for oic-auth//com.nimbusds.openid.connect.sdk.validators.IDTokenValidator.validate(IDTokenValidator.java:254)
 at PluginClassLoader for oic-auth//org.pac4j.oidc.profile.creator.TokenValidator.validate(TokenValidator.java:108)
 at PluginClassLoader for oic-auth//org.pac4j.oidc.profile.creator.OidcProfileCreator.create(OidcProfileCreator.java:109)
Caused: org.pac4j.core.exception.TechnicalException
 at PluginClassLoader for oic-auth//org.pac4j.oidc.profile.creator.OidcProfileCreator.create(OidcProfileCreator.java:153)
 at PluginClassLoader for oic-auth//org.pac4j.core.client.BaseClient.retrieveUserProfile(BaseClient.java:126)
 at PluginClassLoader for oic-auth//org.pac4j.core.client.BaseClient.getUserProfile(BaseClient.java:105)
 at PluginClassLoader for oic-auth//org.pac4j.oidc.client.OidcClient.renewUserProfile(OidcClient.java:69)

规范与实际现象冲突 #

OpenID核心规范明确：即使初始认证的ID Token包含nonce声明，刷新令牌响应中的ID Token不应包含nonce；若存在则其值必须与初始ID Token的nonce一致。

但当前实际表现：

• 当设置OidcConfiguration.setUseNonce(false)时，刷新操作无异常，可正常完成
• 当设置OidcConfiguration.setUseNonce(true)时，刷新令牌触发上述签名验证异常，看起来校验器始终要求刷新后的ID Token必须包含nonce声明，这与规范要求相悖，寻求解决方法。

内容的提问来源于stack exchange，提问作者Francisco Javier Fernandez