bug: Stale Json Web Keys. #2463

New issue

Closed

opened 2026-11-06 00:14:56 +00:00 by mee92117 · 3 comments

mee92117 commented

2026-11-06 00:14:56 +00:00

What is the bug?

Continuwuity remembers OIDC keys once on startup. Rotating the Json Web Keys (JWKs) can cause login failures. My continuwuity instance stopped logging in in November while it was working before.

Continuwuity does not log in after scheduled Rauthy Json Web Keys rotation, which causes users to not being able to log in. I expect it to log in, but instead it shows an error "Bad request" and "Identity server is misconfigured. Contact your homeserver's administrator.".

Steps to reproduce

To reproduce this problem install Rauthy v0.37.2, continuwuity 26.9.1 (abf8f87) and prepare two accounts.

Configure Continuwuity to work with Rauthy identity provider.
Log in to Continuwuity via Rauthy and expect it to succeed.
Log out.
Log in to Rauthy as Rauthy administrator.
Go to Rauthy admin panel -> Config -> JWKS and hit Rotate Keys button.
Wait for JwksRotated event.
Log out.
Try to log in to Continuwuity via Rauthy and expect it to fail.
Send !admin server restart command to continuwuity admin room.
Wait for Continuwuity to start responding.
Log in to Continuwuity via Rauthy and expect it to succeed.

Server name and version

Private server running continuwuity 26.9.1 (abf8f87)

Additional context

I suspect the reason is stale JWKs. In this case the following happen.
Continuwuity does not go back to the jwks_uri location to re-retrieve the keys when it sees an unfamiliar kid value, which causes failure to verify id token claims because signature verification failed. The user sees "Bad request" and "Identity server is misconfigured. Contact your homeserver's administrator.". I expect it to follow OpenID Connect Core 1.0 10.1.1. Rotation of Asymmetric Signing Keys, retrieve new keys and succeed login attempt.

### What is the bug? Continuwuity remembers OIDC keys once on startup. Rotating the Json Web Keys (JWKs) can cause login failures. My continuwuity instance stopped logging in in November while it was working before. Continuwuity does not log in after scheduled Rauthy Json Web Keys rotation, which causes users to not being able to log in. I expect it to log in, but instead it shows an error "Bad request" and "Identity server is misconfigured. Contact your homeserver's administrator.". ### Steps to reproduce To reproduce this problem install Rauthy v0.37.2, continuwuity 26.9.1 (abf8f87) and prepare two accounts. 1. Configure Continuwuity to work with Rauthy identity provider. 2. Log in to Continuwuity via Rauthy and expect it to succeed. 3. Log out. 4. Log in to Rauthy as Rauthy administrator. 5. Go to Rauthy admin panel -> Config -> JWKS and hit Rotate Keys button. 6. Wait for JwksRotated event. 7. Log out. 8. Try to log in to Continuwuity via Rauthy and expect it to fail. 9. Send !admin server restart command to continuwuity admin room. 10. Wait for Continuwuity to start responding. 11. Log in to Continuwuity via Rauthy and expect it to succeed. ### Server name and version Private server running continuwuity 26.9.1 (abf8f87) ### Additional context I suspect the reason is stale JWKs. In this case the following happen. Continuwuity does not go back to the jwks_uri location to re-retrieve the keys when it sees an unfamiliar kid value, which causes failure to verify id token claims because signature verification failed. The user sees "Bad request" and "Identity server is misconfigured. Contact your homeserver's administrator.". I expect it to follow OpenID Connect Core 1.0 10.1.1. Rotation of Asymmetric Signing Keys, retrieve new keys and succeed login attempt.

mee92117 added the

Bug

Status

Needs Investigation

labels

2026-11-06 00:14:56 +00:00

ginger was assigned by Aranjedeath

2026-11-06 01:27:50 +00:00

ginger commented

2026-11-06 02:04:34 +00:00

Owner

Please provide the error that Continuwuity logs to the console when you try to log in. That will have more detail than the error presented to users.

mee92117 commented

2026-11-06 07:35:08 +00:00

Author

conduwuit_service::oidc: Failed to verify id token claims: Signature verification failed
at src/service/oidc/mod.rs:318 on conduwuit:worker ThreadId(4)
in tower_sessions::service::call

``` conduwuit_service::oidc: Failed to verify id token claims: Signature verification failed at src/service/oidc/mod.rs:318 on conduwuit:worker ThreadId(4) in tower_sessions::service::call ```