{"record":{"id":"588a3df277138f01","repo":"xai-org/grok-build","slug":"oidcerror-unsupportedalg","errorCode":null,"errorMessage":"OidcError::UnsupportedAlg","messagePattern":"OidcError::UnsupportedAlg","errorType":"validation","errorClass":"OidcError","httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/oidc/protocol.rs","lineNumber":623,"sourceCode":"        jsonwebtoken::Algorithm::PS512 => \"PS512\",\n        jsonwebtoken::Algorithm::ES256 => \"ES256\",\n        jsonwebtoken::Algorithm::ES384 => \"ES384\",\n        jsonwebtoken::Algorithm::EdDSA => \"EdDSA\",\n        other => match other {\n            jsonwebtoken::Algorithm::HS256 => \"HS256\",\n            jsonwebtoken::Algorithm::HS384 => \"HS384\",\n            jsonwebtoken::Algorithm::HS512 => \"HS512\",\n            _ => \"unknown\",\n        },\n    }\n}\npub(super) fn ensure_alg_allowed(\n    alg: jsonwebtoken::Algorithm,\n    discovery_supported_algs: Option<&[String]>,\n) -> anyhow::Result<()> {\n    let alg_name = alg_to_jwa_name(alg);\n    if !ALLOWED_ID_TOKEN_ALGS.contains(&alg) {\n        return Err(anyhow::Error::new(OidcError::UnsupportedAlg(\n            alg_name.to_owned(),\n        )));\n    }\n    if let Some(supported) = discovery_supported_algs\n        && !supported.iter().any(|a| a == alg_name)\n    {\n        return Err(anyhow::Error::new(\n            OidcError::AlgNotInDiscoverySupportedList {\n                alg: alg_name.to_owned(),\n            },\n        ));\n    }\n    Ok(())\n}\npub(super) async fn validate_and_extract_user_info(\n    token: &str,\n    discovery: &Discovery,\n    expected_issuer: &str,","sourceCodeStart":605,"sourceCodeEnd":641,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/oidc/protocol.rs#L605-L641","documentation":"OidcError::UnsupportedAlg is raised by ensure_alg_allowed when the id_token's JOSE header algorithm is not in the shell's hardcoded ALLOWED_ID_TOKEN_ALGS (RS256/384/512, PS256/384/512, ES256/384, EdDSA). The error carries the JWA algorithm name. This is a deliberate security rejection of algorithms the library refuses to verify.","triggerScenarios":"validate_and_extract_user_info -> ensure_alg_allowed inspects jsonwebtoken::decode_header(token).alg; if ALLOWED_ID_TOKEN_ALGS does not contain it, UnsupportedAlg(alg_name) is returned.","commonSituations":"A provider issues id_tokens signed with HS256 (client-secret symmetric signing) or another non-asymmetric alg; the IdP was configured with an unusual default signing algorithm.","solutions":["Reconfigure the IdP to sign id_tokens with RS256 (or another supported asymmetric alg)","Check the id_token header (alg claim) to confirm which algorithm the provider uses","If the provider cannot change algs, you cannot use it with this shell's OIDC flow"],"exampleFix":"// before (IdP client config)\n\"id_token_signed_response_alg\": \"HS256\"\n// after\n\"id_token_signed_response_alg\": \"RS256\"","handlingStrategy":"validation","validationCode":"// decode the unverified header to see which alg the IdP will use, before the full flow\nfn id_token_alg(token: &str) -> Option<String> {\n    jsonwebtoken::decode_header(token).ok().map(|h| format!(\"{:?}\", h.alg))\n}","typeGuard":"fn alg_supported(h: &jsonwebtoken::Header) -> bool {\n    matches!(h.alg,\n        jsonwebtoken::Algorithm::RS256 | jsonwebtoken::Algorithm::RS384 | jsonwebtoken::Algorithm::RS512 |\n        jsonwebtoken::Algorithm::PS256 | jsonwebtoken::Algorithm::PS384 | jsonwebtoken::Algorithm::PS512 |\n        jsonwebtoken::Algorithm::ES256 | jsonwebtoken::Algorithm::ES384 | jsonwebtoken::Algorithm::EdDSA)\n}","tryCatchPattern":"match res {\n    Err(e) if matches!(e.downcast_ref::<OidcError>(), Some(OidcError::UnsupportedAlg(a))) => {\n        eprintln!(\"IdP signs id_tokens with {a}; reconfigure the provider to RS256\");\n    }\n    other => other?,\n}","preventionTips":["Configure the IdP client to sign id_tokens with RS256 by default","Test a login against a new IdP/realm before rolling it out","Avoid HS256 (symmetric) signing — it is never accepted here"],"tags":["oidc","jwt","algorithm","security"],"backgroundTag":"unsupported-jwt-algorithm","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}