The JWS token provider hardcodes ES256 (ECDSA P-256) for signing and
verifying tokens. This prevents operators from selecting stronger or
more appropriate algorithms without modifying the source code, and
blocks a future migration path to post-quantum algorithms like ML-DSA.
Add two new configuration options under [jwt_tokens]:
- jws_algorithm: selects the signing algorithm (ES256, ES384, ES512,
or EdDSA). Default is ES256 for backward compatibility.
- jws_accepted_algorithms: list of algorithms accepted during token
validation, enabling a migration window where tokens signed with a
previous algorithm remain valid until they expire.
The keystone-manage create_jws_keypair command now generates the key
type that matches the configured algorithm.
Also fix _decode_token_from_id to pass algorithms as a list instead
of a string, and to catch InvalidKeyError and InvalidAlgorithmError
when iterating public keys of mixed types during algorithm migration.
Change-Id: Id97bb3152d4363c607aaac35b6c8f6628fa125d2
Signed-off-by: Mauricio Harley <mharley@redhat.com>
Mauricio Harley
f9a4a551f5