'Keycloak JWT offline valiadation

so I want to implement the offline validation of keycloak JWT token. The offline validation happens by taking the signature part of the JWT token and applying server's public key to validate the signature. The process is described here.

However I am facing an issue, that tokens created by keycloak cannot be verified by the use of the server's public key. For quick validation I use this service.

So here is my example:

I authenticated to keycloak and obtained an access token:

eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJMdTZNY1h4M3ZOeVkydjVwREpDMVBFaUpUUjJSbmc0S0lrSG54NnBtUjNjIn0.eyJqdGkiOiI5ODhkMmVkZS00NmZlLTRjN2EtODk3Ny1hMDA2NGEwMzMyYmIiLCJleHAiOjE1Njk5NjU2MzYsIm5iZiI6MCwiaWF0IjoxNTY5OTM2ODM2LCJpc3MiOiJodHRwOi8vbHVja3kubGhzLXN5c3RlbXMuY29tOjE4MDgwL2F1dGgvcmVhbG1zL0JTQ1MiLCJhdWQiOiJic2NzY2xpZW50Iiwic3ViIjoiNWUyMjJlY2UtZmEyMC00Y2Q4LTk4M2MtY2YyOGNiN2MxNjliIiwidHlwIjoiQmVhcmVyIiwiYXpwIjoiYnNjc2NsaWVudCIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6Ijk5Y2IxMTVlLTE4MTItNDAyYi1hZmFkLWYwOWU1M2VlZDkxMCIsImFjciI6IjEiLCJyZXNvdXJjZV9hY2Nlc3MiOnsiYnNjc2NsaWVudCI6eyJyb2xlcyI6WyJ1bWFfcHJvdGVjdGlvbiIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwiYXV0aG9yaXphdGlvbiI6eyJwZXJtaXNzaW9ucyI6W3sicnNpZCI6Ijc2MjRmMWRmLTVlNTYtNGIzOS1hMjg4LWZhN2MzYmI2YjFmYyIsInJzbmFtZSI6IkRlZmF1bHQgUmVzb3VyY2UifV19LCJzY29wZSI6InByb2ZpbGUgZW1haWwiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsIm5hbWUiOiJBdXRvdGVzdCBBdXRvdGVzdCIsInByZWZlcnJlZF91c2VybmFtZSI6ImF1dCIsImdpdmVuX25hbWUiOiJBdXRvdGVzdCIsImZhbWlseV9uYW1lIjoiQXV0b3Rlc3QifQ.douJsDyObXAKylBexZCTQvEU5v3OY5xJtfNxnUhwDpIOoN1lpw7Tdxwf3jsEWi-ZTKVzV3H1zjhorPCs02tAjjpH9bDQHQmSBtn4R8V2dbXbIedBxK0kl_YfnrYTFPX66lQTpHWoWP9qngxoEqOJcFSnDFnPHwwz774PUZdqPA4FZOwb02LxDtUVKdBfM_bI41LDD2Nsvc_sKuTVuq_dbST3CqjlapAo-Q61vgSoH1zMtCGy9XUBOs1nhyeDhAaGVGcPYD3RwqYuRkfKPl0BuuB_5D8Z1xaEp-1G8M06vMIW0HpESp-NUTUb30rGib5EmAlW3rT6M2_8B6oUUtGhhA

The JWT token has been generated with a kid: Lu6McXx3vNyY2v5pDJC1PEiJTR2Rng4KIkHnx6pmR3c. So In my keycloak installation, the key with this ID has public key:

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgk9p0QOXtnzsQIVviM4kEoIGtewKAqUG9CtlQ6Esd6Z2RMu5qvQb8iBQVvkiFSHXGEd3kJqY3H7KZk+pkFuoQSdsLqGM5UhPeMjk2pIog0n0lXDxcd6Ff8hywmiIgfIWJW5DeDwvGTPLR1BiLPiina2qemACwUk5VCVdRzr2ob712PohcyNIa34PasPI1kBve0ks/wKNZK5vnGDPC6orFlJL48t2e2gB0Lz5rAJ1l2MJ+tV3cXjjB5wh62cWyJ/xYThGsK48vaXciTRVn8/sZRoJA4c+ZLKg28YOry9zHnAO8B+mj17Nj5Chpat6iYv00pqA0lMxiiQeK6yXxT6cswIDAQAB

The corresponding certificate:

MIIClzCCAX8CBgFrVaYX1jANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARCU0NTMB4XDTE5MDYxNDEwNTkzNloXDTI5MDYxNDExMDExNlowDzENMAsGA1UEAwwEQlNDUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIJPadEDl7Z87ECFb4jOJBKCBrXsCgKlBvQrZUOhLHemdkTLuar0G/IgUFb5IhUh1xhHd5CamNx+ymZPqZBbqEEnbC6hjOVIT3jI5NqSKINJ9JVw8XHehX/IcsJoiIHyFiVuQ3g8Lxkzy0dQYiz4op2tqnpgAsFJOVQlXUc69qG+9dj6IXMjSGt+D2rDyNZAb3tJLP8CjWSub5xgzwuqKxZSS+PLdntoAdC8+awCdZdjCfrVd3F44wecIetnFsif8WE4RrCuPL2l3Ik0VZ/P7GUaCQOHPmSyoNvGDq8vcx5wDvAfpo9ezY+QoaWreomL9NKagNJTMYokHiusl8U+nLMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEACJ2h6p7b9j8MPJPhvEp00WoT3kv0r3WS/8CFDPugV6WPrEexGO8aCOmn5/4GqoVGux6whnAxEZIQrTtufnMg+LCV5kEhOrHOuM2JHcA/AmkMOSXnnJXlH1gwYvOa1LV0rWxOiWvVI1bsK4Q3gelZu8CEVxluN0SU/g/9tkntFmXqARHl7BEVuBCnnEje8rVonDctmUzsb97DzXVFIIP3sUIq0B+1M3u0+Nm008u30FrZ7OOJm7qXC0KR9XOkqcTYga/4dDJ2h25bpulgFU/c0VYxCRbs+5zEij5RGbj8pW3XayPyNndNH6E00zwOeEgaBajOx+JLchg9hPKGOdeQuw==

At this point it looks like the token cannot be validate with neither the key, nor the certificate... Do I need to set some settings in keycloak to enable the offline validation? Or is it an error on the jwt.io service? What is the correct way to offline validate a keycloak jwt token?

Thank you in advance!

keycloak

Solution 1:^[1]

The issue actually was on the jwt.io website. You have to input the public key as follows:

This way the service verifies jwt token correctly.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source
Solution 1	Aksim Elnik

'Keycloak JWT offline valiadation

Solution 1:[1]

Sources

Related Questions

Solution 1:^[1]