Unexpected JWT auth response "badmatch" about couchdb

[big-r81]

Hi,

can you paste your JWT token?

[rnewson]

I think it's a decode error for the public key in the config, @big-r81

we don't need the token

[rnewson]

we should catch and rethrow as something more presentable, but the config is wrong.

[rnewson]

4> public_key:pem_decode(BinPEM).
[{'SubjectPublicKeyInfo',<<48,130,2,181,48,130,1,157,2,6,
                           1,136,80,108,152,219,48,13,6,9,
                           42,134,72,134,247,13,...>>,
                         not_encrypted}]
5> [PEMEntry] =public_key:pem_decode(BinPEM).
[{'SubjectPublicKeyInfo',<<48,130,2,181,48,130,1,157,2,6,
                           1,136,80,108,152,219,48,13,6,9,
                           42,134,72,134,247,13,...>>,
                         not_encrypted}]
6> public_key:pem_entry_decode(PEMEntry).
** exception error: no match of right hand side value {error,{asn1,{{wrong_tag,{{expected,6},
                                                                                {got,2,{2,<<1,136,80,108,152,219>>}}}},
                                                                    [{'OTP-PUB-KEY',match_tags,2,
                                                                                    [{file,"OTP-PUB-KEY.erl"},{line,23999}]},
                                                                     {'OTP-PUB-KEY',decode_object_identifier,2,
                                                                                    [{file,"OTP-PUB-KEY.erl"},{line,23557}]},
                                                                     {'OTP-PUB-KEY',dec_AlgorithmIdentifier,2,
                                                                                    [{file,"OTP-PUB-KEY.erl"},{line,14558}]},
                                                                     {'OTP-PUB-KEY',dec_SubjectPublicKeyInfo,2,
                                                                                    [{file,"OTP-PUB-KEY.erl"},{line,15014}]},
                                                                     {'OTP-PUB-KEY',decode,2,
                                                                                    [{file,"OTP-PUB-KEY.erl"},{line,1232}]},
                                                                     {public_key,der_decode,2,
                                                                                 [{file,"public_key.erl"},{line,358}]},
                                                                     {public_key,pem_entry_decode,1,
                                                                                 [{file,"public_key.erl"},{line,226}]},
                                                                     {erl_eval,do_apply,6,[{file,"erl_eval.erl"},{line,689}]}]}}}
     in function  public_key:der_decode/2 (public_key.erl, line 362)
     in call from public_key:pem_entry_decode/1 (public_key.erl, line 226)
7>

[tommyli]

OK, thanks for confirming that the key config is wrong, I worked out what happened.

I'm using Keycloak and I used the certificate instead of the public key from the realm settings. The cryptic error is probably trying to parse a public key but was given a certificate, i.e. the error {"error":"bad_request","reason":"not an RSA public key"} is a lot more meaningful as soon as I used -----BEGIN CERTIFICATE----- instead of -----BEGIN PUBLIC KEY-----.

It's working now, thanks for your help.

[rnewson]

:)

[rnewson]

yup, error handling is poor here, we'll improve it.