Laravel SSO Laravel SSO

v2.1.1

The key set keeps the signing key you retire, so a rotation no longer strands the tokens signed before it.

On this page 3

A fix release. The key set used to publish the active signing key alone, so rotating it was a hard cutover: every ID Token signed before the swap stopped verifying at that moment. It can now keep the key you retire next to the active one, which is what OpenID Connect Core 1.0 section 10.1.1 asks:

The JWK Set document at the jwks_uri SHOULD retain recently decommissioned signing keys for a reasonable period of time to facilitate a smooth transition.

Release notes on GitHub · Every change since v2.1.0

Added

  • SSO_PREVIOUS_PUBLIC_KEY, or a storage/oauth-previous-public.key file, holds the public key retired by the last rotation. /.well-known/jwks.json publishes it after the active key, under its own kid.
  • A malformed retired key is left out of the key set and reported, so an optional key can never take the key set down with it.

Fixed

  • ID Tokens signed before a rotation go on verifying while the retired key is kept. A client that meets their kid finds the key in the key set.
  • An id_token_hint signed by the retired key still signs the user out straight away, instead of asking first.

Upgrading

Nothing is required. To rotate a signing key, follow Rotating in the deployment guide, which also covers what happens to access tokens during the change.