Changing minimum RSA Key size

[user123]

Hello, I am running into the same issue as discussed on this thread:

OIDC Authentication troubleshooting issue: unable to view log details

On a fresh 1.4.0-1 install, I’ve setup oidc authentication against our keycloak server. Here’s the configuration --- _meta: type: "config" config_version: 2 config: dynamic: authc: openid_auth_domain: http_enabled: true transport_enabled: true order: 0 http_authenticator: type: openid challenge: false config: subject_key: preferred_username …

I was wondering how, if possible, would I be able to change the minimum required RSA Key length on my OpenSerach server end (lower it to 1024 bits), instead of increasing the Key size from my OIDC IdP?

Thanks.

[pablo]

Hello @user123

Based on the answer from the mentioned thread, I find that issue is not related to security plug-in but to Apache CXF. 2048 limit is defined in Apache code.

OIDC Authentication troubleshooting issue: unable to view log details

The message is not very clear “INVALID_KEY” but as it has been raised by checkSignatureKeySize, I’ve been able to find that the minimum key length authorized is 2048 ( see code cxf/JwsUtils.java at main · apache/cxf · GitHub ). So we have to change the rsa key of our keycloak server which is a 1024 bit length.

In that case, the only solution is to change the key size in your OIDC IdP.

[user123]

Hi,

thanks for your reply. Is there a config anywhere to change that CXF parameter? Or perhaps something in the “java.security” config file in the OpenSearch source code? My company’s IdP uses 1024 bits and is having issues increasing the length at the moment, and I’d like to continue devs on my side.

[pablo]

Hi @user123

I’m not aware of such a possiblity.