https://linen.dev logo
Join Slack
Powered by
Hi we are on Druid version 33. Trying to setup SSO...
# general
v
Hi we are on Druid version 33. Trying to setup SSO with Microsoft Entra ID using Pac4j. Getting this exception. HTTP ERROR 500 org.pac4j.core.exception.TechnicalException: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found URI: /druid-ext/druid-pac4j/callback STATUS: 500 MESSAGE: org.pac4j.core.exception.TechnicalException: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found SERVLET: org.eclipse.jetty.servlet.DefaultServlet-41bdaa81 CAUSED BY: org.pac4j.core.exception.TechnicalException: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found CAUSED BY: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
• With some Copilot analysis, this appears to be the root cause. Token 
kid
(**) missing from default JWKS • Entra app appears configured with app-specific tenant-scoped signing keys • Token signed by 
/{tenant}/discovery/keys?appid={client_id}
, while pac4j validates against 
/common/discovery/keys
from discovery doc • Result: pac4j cannot find matching kid → 
BadJOSEException
Any ideas on how to resolve.
Hi checking on this again
Open in Slack
PreviousNext
Powered by