<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D54z0000A1ATR1CQOOkta Classic EngineAuthenticationAnswered2024-03-21T12:26:42.000Z2024-03-07T15:08:32.000Z2024-03-21T12:26:42.000Z

User15905026051312106517 (Customer) asked a question.

March 7, 2024 at 3:08 PM

The JWKS endpoint did not contain any signing keys

We have implemented a couple of years ago Okta for a client of ours.

I was getting messages from the customer that the login procedure is no longer working in our application.

 

We are connecting to their Okta environment with our application (React).

I have verified the token that I get back and all seems to be ok with it.

After digging deep inside the react libraries I found that the problem is with the Cryptokey.

It is the following that I get

/help/servlet/rtaImage?refid=0EM4z000007oUeI

What I see here is that it is a public type but the extractable is set to "false".

Then the library is eventually throwing the error that there are no signing keys.

 

This was working in the past (x years ago).

The customer is administrating the Okta side. We do not have access to their Okta administration.

Is there some setting that they have done that would mark the public keys not to be extractable?

 

Thanks for any help.

Steve

 

 

  • 3 answers
  • 570 views

  • Paul S. (Okta, Inc.)

    Hello @User15905026051312106517 (Customer)​ Thank you for reacting out to our Community!

     

    I was able to find a few similar questions on this matter, please see below:

    https://devforum.okta.com/t/jwt-authentication-fails-app-keys-not-in-oauth2-default-v1-keys/11346

    https://devforum.okta.com/t/unable-to-resolve-key-for-token-signature/8257

     

    Additionally if you need further assistance we recommend to leverage the Okta Developer forums for this type of questions and take advantage of their expertise.

    https://devforum.okta.com/

     

    Community members help others by clicking Like or Select as Best on responses. Try it today.

     

    Earn Today: New Okta Community Badges Have Arrived

     

    Ask the Experts: Okta Device Access Product Team Now Thru 3/22

    Expand Post
    Selected as Best

  • User15905026051312106517 (Customer)

    Hi Paul,

     

    unfortunatly I can't find anything in the links you provided me that relates to the fact that the CryptoKey is marked with extractable = false.

     

    As mentioned, I did not make any changes to our application. This was always working up until X period ago.

    The customer has the control over the Okta administration itself. So, I can't know if they have changed settings or added new keys/tokens or what so ever.

    In the meantime they are investigating themself also what could have been changed.

     

    I only know about our code implementation about calling the verifyAccessToken function on the Okta library. (Code was created 3 years ago by someone else then me in the project)

     

    The closest thing I could find online about that property is when someone generates it's own certificates and then sets the property extractable on the public key to false.

     

    kind regards,

    Steve

    Expand Post

  • User15905026051312106517 (Customer)

    Hi all,

     

    I had to do a fresh deploy of the application. It didn't contain any changes related to the Okta login.

    But for some reason it is working again.

    Really frustrating of not knowing what the actual problem was now.

     

    Anyway thanks for the suggested links.

     

    kind regards,

    Steve

    Expand Post
This question is closed.
Loading
The JWKS endpoint did not contain any signing keys