Micke Nordin dae8a36460 fix(ocm): treat RFC 9421 keyid as opaque, verify by sender origin ...

RFC 7517 §4.5 leaves the keyid structure unspecified, so the receiver
must not parse it. The signer origin now comes from the trusted OCM
share/sender identity; the JWK Set is resolved against that origin and
the keyid is matched opaquely to the JWKS kid. Aligns with the OCM
verification procedure and fixes the origin-mismatch / flaky-kid
failures in the two-port integration rig.

Reverts the per-request host-based kid back to a stable persisted kid,
drops keyid->host parsing, threads a sender-origin parameter through
verification, and resolves that origin in every OCM inbound entry point
(notifications, shares, token exchange, OCM requests) and the federation
rate limiter. Cavage is unchanged.

Assisted-by: ClaudeCode:glm-5.2

Signed-off-by: Micke Nordin <kano@sunet.se>

2026-08-09 16:21:06 +02:00

..

Rfc9421RoundTripTest.php

fix(ocm): treat RFC 9421 keyid as opaque, verify by sender origin

2026-08-09 16:21:06 +02:00