Enforcing algorithm values

[jalauros]

Environment

Any

Expected behaviour

When using primitives like OIDCUserInfoSignedResponseAlg the RP should verify that the received response has actually been signed with the listed algorithm(s).

Actual behaviour

If one sets for instance value RS256 for the OIDCUserInfoSignedResponseAlg the RP is able to handle the incoming signed response and validate it but it does not verify the algorithm is actually RS256.

Minimized example

Configuration and Apache server log files

[zandbelt]

It turns out that this is actually a spec requirement, as follows out of this discussion: openid-certification/oidctest#207 so I'm reclassifying as a bug that needs to be addressed for the next release.

[zandbelt]

@jalauros can you try with https://mod-auth-openidc.org/download/mod_auth_openidc-2.4.1rc2-1.el7.x86_64.rpm ?

[zandbelt]

now released in 2.4.1