Remediate

Remediation

The platform recommends changes and records progress. Engineers implement changes through the Bank's own change process; nothing is modified automatically.

OPEN13
ASSIGNED4
CHANGE PLANNED1
IMPLEMENTED0
RETEST REQUIRED0
VERIFIED0
CLOSED0
18
REM-103FND-1044CriticalOPEN

Signing key selected by position, not kid

  1. OPEN→
  2. ASSIGNED→
  3. CHANGE PLANNED→
  4. IMPLEMENTED→
  5. RETEST REQUIRED→
  6. VERIFIED→
  7. CLOSED
Current state

jwks.kid.selection = static (first key)

Required state

jwks.kid.selection = dynamic (match JWS kid header)

Recommended change

Implement kid-based key lookup with cache refresh on unknown kid; add a key-rollover test to the migration suite.

Affected systems
Jans IAM
Dependencies
Change advisory board; Sandbox validation
Risk
Critical
Suggested test
TST-019 Key rollover with kid
Evidence required
  • Configuration snapshot (post-change)
  • Test result with PASS
  • Engineer attestation
Ownership