Closed
Description
Describe the bug
The DPoP Thumbprint in the jkt
claim is calculated according to RFC7638, and the spring implementation does a certificate thumbprint, not a JWK Thumbprint
To Reproduce
- Generate a DPoP Proof using: https://github.com/panva/openid-client
- This will create the
jtk
claim using a JWK Thumbprint according to the RFC - Spring cannot validate it, and the DPoP Proof is rejected. :(
Expected behavior
The DPoP proof should be valid!
Sample
PR to follow shortly showing the difference and fix once validated, if we are unable to prove that it works, we'll create a sample repo.