Re: [Unity-idm-discuss] Algorithm on token introspection

[Krzysztof B. <kb...@un...>]

W dniu 10.10.2025 o 14:07, Sander Apweiler pisze:
> Dear Krzysztof,
> dear Roman,
>
> We are working on integration with EOSC and configuring the token
> introspection for this. It seems that EOSC AAI uses an algorithm, which
> is not supportet by unity:
>
> 2025-10-07T12:16:56,494 [qtp1797879583-58] DEBUG unity.server.oauth.RemoteTokenIntrospectionService: Remote token introspection, token ...1cda2b
> 2025-10-07T12:16:56,495 [qtp1797879583-58] DEBUG unity.server.oauth.OAuthDiscoveryMetadataCache: Get fresh oauth OIDC metadata fromhttps://proxy.acc.myaccessid.org/.well-known/openid-configuration
> 2025-10-07T12:16:56,495 [qtp1797879583-58] DEBUG unity.server.oauth.OpenIdConnectDiscovery: Download metadata fromhttps://proxy.acc.myaccessid.org/.well-known/openid-configuration
> 2025-10-07T12:16:56,674 [qtp1797879583-58] DEBUG unity.server.oauth.OAuthJWKSetCache: Get fresh JWKSet fromhttps://proxy.acc.myaccessid.org/OIDC/jwks
> 2025-10-07T12:16:56,675 [qtp1797879583-58] DEBUG unity.server.oauth.KeyResource: Download JWKSet fromhttps://proxy.acc.myaccessid.org/OIDC/jwks
> 2025-10-07T12:16:56,752 [qtp1797879583-58] ERROR unity.server.oauth.RemoteTokenIntrospectionService: Invalid sign of token ...1cda2b
> com.nimbusds.jose.JOSEException: Unsupported JWS algorithm ES256, must be RS256, RS384, RS512, PS256, PS384 or PS512
>
> Is there a possibility to support ES256 as well or requires this code
> changes?


This is strange - this algorithm should be supported since long time. 
Can you please provide which version of Unity you are using and which JDK?

Also - is there an option to get some token for verification (can be 
expired)?

Thanks,
Krzysztof