JWKs use sig vs enc

[istibekesi]

I've created two JWKs using hydra admin api.
First key is configured with use: sign, second with use: enc

{
  "keys": [
    {
      "use": "sig",
      "kid": "public:hfEdc2PBiJqNFBO5enh6QkfCkiuFtvJVVob5t2uxQDA",
      ...
    },
    {
      "use": "enc",
      "kid": "public:i37Z1ZRN8VvF4cJgVUrOhnCwRUj3SbM63GEWnqptljk",
      ...
    }
  ]
}

According to my test results, the configuration above produces id_token signed with the key having use: enc.
Instead of the one specified with use: sig (The JWT header kid matches the sign key too)

How the selection works in case of multiple jwks?
Is there any way to configure this behavior?

[aeneasr]

Hi, please try this on Ory Hydra 2.0!

[istvan-bekesi]

I've the started Hydra 2.0 locally according to the 5 minute tutorial and reproduced the issue.

1. Start Hydra 2.0

2. Check version

GET http://127.0.0.1:4445/version

{
    "version": "v2.0.1"
}

3. Create a new JWKs via admin api

POST http://127.0.0.1:4445/admin/keys/hydra.openid.id-token
{
  "alg": "RS256",
  "kid": "hellokid",
  "use": "enc"
}

4. Check well-known endpoint

GET http://127.0.0.1:4444/.well-known/jwks.json

{
    "keys": [
        {
            "use": "enc",
            "kty": "RSA",
            "kid": "hellokid",
            "alg": "RS256",
            ...
        },
        {
            "use": "sig",
            "kty": "RSA",
            "kid": "2a7b3f9e-d105-49ba-82cc-b1656f69cf9d",
            "alg": "RS256",
            ...
        }
    ]
}

6. Start example web application and perform a login

Returned id_token_hint:

eyJhbGciOiJSUzI1NiIsImtpZCI6ImhlbGxva2lkIiwidHlwIjoiSldUIn0.eyJhY3IiOiIwIiwiYXRfaGFzaCI6IkhlYTdQajdiWTRaeVp0VWZrR3FyX0EiLCJhdWQiOlsiY2I4NTMzYzQtMTUyYi00NTYzLTgzZGMtZmEwNjZjZGNjMGY1Il0sImF1dGhfdGltZSI6MTY2ODA4OTc1MiwiZXhwIjoxNjY4MDkzMzU2LCJpYXQiOjE2NjgwODk3NTYsImlzcyI6Imh0dHA6Ly8xMjcuMC4wLjE6NDQ0NCIsImp0aSI6ImU2OGE0ZjlmLTczY2YtNGQwZi1iNThhLWM0YzYyNzQzYzI1YyIsIm5vbmNlIjoiY3h3eXNja2VpZXZ3ampweG96b2hueHRiIiwicmF0IjoxNjY4MDg5NzQxLCJzaWQiOiIzMmY2N2Q1ZC0xMjQxLTQ2YjAtOWQyMi0xNTFlMTZlNmVhYjgiLCJzdWIiOiJmb29AYmFyLmNvbSJ9.eOlwBTUk_isgpJ-GM3X0Nc4y-4FvcL3adcgix1JMckslE-HywhXDY8Q34PuJcmXvGNWPaR8tx8f-P_5rlQNEtx2m1v6xrXmJeDsvChZI00ET1TBH9EzPNcsDmekKLIg1id6mthzFXXh6NfJYiENDFYc1r-k0pICrpM_RP6wH2ciI-FynFh9YGIpgSCY0832UrcEL7PIFHMEEfiey9MbOXQPQwRgXO_33gqSDlHuq4CLhNyGhy4YmYukKD6qIrTM0JtObmMXU0udBX4QrJKcH9EhX5gWpscA7aEYdUxmjK6hGblg-Xt-VSDU35Xuyp-o3lJU8xc12dGB91d5wI7pM1NnRNegxo6dfhq7QbQLjhBvQoUawhfNuJ4QQgyd0tqTKWRrGN59MHHJbGTnWTNm1EPFPNmid1-rH71XA-BqgUfPTg2LLz1CVz6k6Z3CThon-1roF9DJyq_EkmUOU03jwkgLBvUzqA7PtjVEyje40PMK0UuRnYX-Frk6bGO8JUO37nLdYVN-bq9Kb_hWkIk1_VCxb2pirk5SpBqlgt9UGAZKnE-ylMbpo4gLD_wE7GoV0dqcCGU5GVZ4CadWUqdJMOVRr9DoMwkAEdgiJAxc9qIj8jmf4lq3utAyQ7hJ3-J7x379yQrUrN2QRwA0t5oPdgZF-XOqNLFKVS_yZ0jOURP0

7. Decode the id_token_hint
   Decoded header:

{
  "alg": "RS256",
  "kid": "hellokid",
  "typ": "JWT"
}

The token was signed by the use: enc jwk.
@aeneasr Can you take a look at it and check if is there any way to control this behaviour?