FND-1044 · JWKS · Production
Signing key selected by position, not kid
CriticalOpenCutover blocker
Detected vs required
Detected configuration
jwks.kid.selection = static (first key)
Required target
jwks.kid.selection = dynamic (match JWS kid header)
Impact
Directory key rollover will cause SSA and token signature verification to fail for all TPPs.
Remediation guidance
Implement kid-based key lookup with cache refresh on unknown kid; add a key-rollover test to the migration suite.
Remediation workflow: OPEN · Owner A. Whitfield · Due 2026-09-26
Evidence
1 artefacts linked to this finding or its control on the affected system
- EVD-2018Key rollover with kid — FAILJWKS test11 Sept, 11:06Pending
Context
- System
- Jans IAM
- Environment
- Production
- Control
- JWKS-002 — Signing keys selected dynamically using kid
- Category
- JWKS
- Owner
- Unassigned
- Detected
- 13 Sept, 06:12
- Evidence ref
- KeyResolver.java · Line 88
- Cutover blocker
- Yes
Linked tests
TST-019Key rollover with kidFAIL