Using beginner example: "Caused by: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found"

[okta]

Using beginner example: "Caused by: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found"

[kiplaaang]

So here's the problem I've found after debugging:
when I try decoding an id_token, it works no problem, and the key Id (kid) matches for the it token and the keys returned from https://dev-******.oktapreview.com/oauth2/v1/keys

However, when trying to decode the access token, the kids don't match. I'm not really sure why this is.

[kiplaaang]

Ignore everything I said! This issue can now be closed.

Basically what I found: I was using an Okta dev account, and setup a new application using OIDC, but was using the default authentication server. While the kid in an id_token would always match fine, it just never seemed to work using the access token's kid (and further note! using {site}.oktapreview.com as the root, vs {site}.oktapreview.com/oauth2/default would return different keys).

I finally created my own authentication server in Okta, and used that for everything instead, and now everything seems to work fine! Spent a full day trying to figure that out.

[bdemers]

@kiplaaang Thanks for following up!
This is related to #13, we will try to get a more descriptive error message when this happens