diff --git a/lib/galaxy/authnz/custos_authnz.py b/lib/galaxy/authnz/custos_authnz.py index 33bd6a1c1f1..92c3074becd 100644 --- a/lib/galaxy/authnz/custos_authnz.py +++ b/lib/galaxy/authnz/custos_authnz.py @@ -42,7 +42,7 @@ class CustosAuthnz(IdentityProvider): elif provider == 'keycloak': self._load_config_for_keycloak() - def _decode_token(self, token): + def _decode_token_no_signature(self, token): return jwt.decode(token, audience=self.config['client_id'], options={"verify_signature": False}) def authenticate(self, trans, idphint=None): @@ -80,7 +80,7 @@ class CustosAuthnz(IdentityProvider): # Get nonce from token['id_token'] and validate. 'nonce' in the # id_token is a hash of the nonce stored in the NONCE_COOKIE_NAME # cookie. - id_token_decoded = self._decode_token(id_token) + id_token_decoded = self._decode_token_no_signature(id_token) nonce_hash = id_token_decoded['nonce'] self._validate_nonce(trans, nonce_hash) @@ -147,7 +147,7 @@ class CustosAuthnz(IdentityProvider): # Get nonce from token['id_token'] and validate. 'nonce' in the # id_token is a hash of the nonce stored in the NONCE_COOKIE_NAME # cookie. - userinfo = self._decode_token(id_token) + userinfo = self._decode_token_no_signature(id_token) # Get userinfo and create Galaxy user record email = userinfo['email'] @@ -183,7 +183,7 @@ class CustosAuthnz(IdentityProvider): raise Exception("User is not associated with provider {}".format(self.config["provider"])) if len(provider_tokens) > 1: for idx, token in enumerate(provider_tokens): - id_token_decoded = self._decode_token(token.id_token) + id_token_decoded = self._decode_token_no_signature(token.id_token) if (id_token_decoded['email'] == email): index = idx trans.sa_session.delete(provider_tokens[index])