Sammy Verstappen (GPS N.V.) asked a question.

September 1, 2025 at 2:54 PM
An error occurred while attempting to decode the Jwt: Failed to load JWS keys

We have a webabl that uses oauth2 and jwt from google. After we have updated our development environment from Openedge 12.8.4 to 12.8.9 it doesn't work anymore.

The error it gives is: 'An error occurred while attempting to decode the Jwt: Failed to load JWS keys'

 

The settings we are using in oeablSecurity.properties:

 

 client.login.model=oauth2

 jwtToken.keystore.type=jwk

 jwtToken.keystore.jwkurl=https://www.googleapis.com/oauth2/v3/certs

 jwtToken.signatureAlg=RS256 

 oauth2.resSvc.audience=73xxxxxxxx.apps.googleusercontent.com

 oauth2.resSvc.tokenServices=jwt

 

We have a 12.8.4 environment where it still works. And we have another webabl that works with microsoft authentication, that stills works in 12.8.4 and 12.8.9. 

 

Any ideas about what is wrong?

 

Thanks

  • 2 answers
  • 295 views
Carlos Vega, Jeffrey Beutels, and 3 others like this.

  • Sammy Verstappen (GPS N.V.)

    I have enabled extra logging based on this https://docs.progress.com/bundle/pas-for-openedge-management/page/Debug-logging-for-OAuth2.html

     

    In the log I now found this:

    c.p.a.s.security.jwk.OEJwkJwtDecoder - Decoding token with JWK: eyJh....

    c.p.a.services.security.jwk.KeyCache - Requesting keys using URL 'https://www.googleapis.com/oauth2/v3/certs'  

    c.p.a.services.security.jwk.KeyCache - Call response '{'  

     

    If I read the token from the 'Decoding token with JWK'-line in c# it works. So that seems to be ok.

    I think it's weird that the call response is only '{'. Maybe some Carriage Return and Line Feed issues?

    With the microsoft authentication it's correct: Call response '{"keys":[{"kty":"RSA","use":....

    • DecodingTokenWithJWK

  • Gonzalo Arito (Customer)

    Hello, I have the same issue with OpenEdge v12.8.9, a workaround I tried that works is to "flatten" the JSON body of the JWK to one line:

     

    • 👍 Accepted way:
    1. {"keys":[{"n":"tOsl2l6pVSQEH17RPSE8rGGIdicatzPGK3xCZ0sgxNHZad4FIsBaWlXEKXxNIWZbwa7YdlpsfhyLJ3mbnWKX0BG-khI43gxGLjrpCr3fTDrJJxxJTdbSUdemq4mQVwhpXI7jDvZq0Vv9M00cgroUlDStzqsqycMK7xrWP0TeBXreZ49xOtt5dFcXEXGesfLexmHURqB39o_ZKfaY-Xf49LexyPcuLKaYPz3n6xHA4pDlosNf6KNyg0aJdDN4abcDZKTMjx6LhmjjfNfDG2yzoAbpe5Kn-G6ogTGBCS1nRgEJMZ4FEpNFa1Tv4PPJUk5acWs3jpTu7iyEJm1SSzxHuw","use":"sig","e":"AQAB","kid":"4b11cb7ab5fcbe41e948094e9df4c5b5eca0009e","alg":"RS256","kty":"RSA"},{"e":"AQAB","alg":"RS256","use":"sig","n":"3x8azZ6BkvIYHPqBUALJY7jHdmRdU9KNbZGT67bLSlPClbOA35YaJAjKnal-51uzgewG8Ywz-nVvouLf5eJkKmgGMUkXdrcpZVa0e-W0oJS8_RaIN0wU5qRon7mamWS-pNx6ZRbtloL0hYCUcX4kAxcgA-W_boqJKXR9Z0G_aFV-IEDFTP99s9_VVih0MpxVN4fpiIFZGh9bPrR4vXiRVTdN_E0oLumUiVJFlNguldgE53rsmW8qnAa0s8JmWth1uQrmN0DNac6HPdXFmzMar8UE16_6EmbHihIXZKcyQij6uvSAeNBDahO3sPlcmNa5LnhfOMrBNTH4QZ0ymCe3yw","kty":"RSA","kid":"f533033a133ad23a2c9adcfc18c4e3a71afaf629"}]}
    • 👎 NOT Accepted way:
    1. {
    2. "keys": [
    3. {
    4. "e": "AQAB",
    5. "n": "00s40KR0OJeiLVt1PEC9Ne0KNfGn87btSX2HUdqgvYfYFFwW6kt7AL8bWdUb7frcZzPTULArOvzpujr1aVJR5GdNhilN0vojXvh2lCZ81MSvAUz7ByrYAdSPdP41wdTbcNB54TvOpqZ7ATxWL3mzY6dgE8_5s1jDbi2GaWSAWEOfZlFOG8NOq09_-LYQjVXJIfC7dkTt2Zil4VZXo1qjqs83Uk4XkDw5lg2Opmj_zF6FwmOEQ4rrACvjJApQgrneYaQtpqszCBvAoF01IvyQgzL5XibXuR6ZjK6Saj9FFFFJVL5Eng4fiOaUIZtqD4IWZI0rVxZny906ifO6zrgXfQ",
    6. "kid": "f758e563c0b64a75f7e3dae494d39595c140ef93",
    7. "use": "sig",
    8. "kty": "RSA",
    9. "alg": "RS256"
    10. },
    11. {
    12. "e": "AQAB",
    13. "kid": "4b11cb7ab5fcbe41e948094e9df4c5b5eca0009e",
    14. "alg": "RS256",
    15. "kty": "RSA",
    16. "n": "tOsl2l6pVSQEH17RPSE8rGGIdicatzPGK3xCZ0sgxNHZad4FIsBaWlXEKXxNIWZbwa7YdlpsfhyLJ3mbnWKX0BG-khI43gxGLjrpCr3fTDrJJxxJTdbSUdemq4mQVwhpXI7jDvZq0Vv9M00cgroUlDStzqsqycMK7xrWP0TeBXreZ49xOtt5dFcXEXGesfLexmHURqB39o_ZKfaY-Xf49LexyPcuLKaYPz3n6xHA4pDlosNf6KNyg0aJdDN4abcDZKTMjx6LhmjjfNfDG2yzoAbpe5Kn-G6ogTGBCS1nRgEJMZ4FEpNFa1Tv4PPJUk5acWs3jpTu7iyEJm1SSzxHuw",
    17. "use": "sig"
    18. }
    19. ]
    20. }

    We've created a little proxy (fake) webservice that request the real (non flattened) keys URL each time the (fake, flattened) URL is hit by PAS (which shouldn't happen very often since PAS caches the keys).

    This way, we also solve the issue of Google (Firebase) key rotation.