Where to get Public key for validating a JWT Token in Java or Kotlin

Question

I am using Kotlin with Vertx at the Backend and the frontend forwards me a JWT token after getting authenticated from One Login. Now, I want to make sure that the Token is valid not fake(made up). If I follow following link, it says that I need a public key to be able to create a JWTAuth object which I can use to call authenticate for validation. https://vertx.io/docs/vertx-auth-jwt/kotlin/

I need to know where can I get public key?

Answer 1

I don't know about OneLogin but from their documentation I can see that they are a SAML/OpenId Connect provider, so the public key can easily retrieved from their configuration. According to their docs you can locate your instance config from:

https://<subdomain>.onelogin.com/oidc/.well-known/openid-configuration

From this file you should look up the key jwks_uri which will hold a value like: https://acme.onelogin.com/oidc/certs. If you get this URL you'll have a JSON similar to this:

{
  "keys": [
    {
      "kty": "RSA",
      "kid": "JRcO4nxs5jgc8YdN7I2hLO4V_ql1bdoiMXmcYgHm4Hs",
      "n": "z8fZsz...GHSTAoQw",
      "e": "AQAB"
    }
  ]
}

This file is a JSON Web Key (chain) This JSON can be feed to JWTAuth to load the key and do the validation you need. As a side note for 3.6 The will be proper OpenId Connect Discovery support in the module OAuth2 which means you don't need to fiddle with this anymore and just pass the URL if your provider and everything will be properly configured.