Fix verification of JWT using verify keys

CHANGELOG.md

@@ -9,6 +9,7 @@ The format is based on the [KeepAChangeLog] project.
 
 ### Fixed
 - [#503] Fix error on UserInfo endpoint for removed clients
+- [#508] JWT now uses verify keys for JWT verification
 
 ### Removed
 - [#494] Methods and functions deprecated in previous releases have been removed
@@ -19,6 +20,7 @@ The format is based on the [KeepAChangeLog] project.
 [#494]: https://github.com/OpenIDC/issues/494
 [#496]: https://github.com/OpenIDC/pyoidc/issues/496
 [#503]: https://github.com/OpenIDC/pyoidc/issues/503
+[#508]: https://github.com/OpenIDC/pyoidc/issues/508
 
 ## 0.13.0 [2018-02-19]
 

src/oic/utils/jwt.py

@@ -94,8 +94,7 @@ def _verify(self, rj, token):
         else:
             owner = _msg['iss']
 
-        keys = self.keyjar.get_signing_key(jws.alg2keytype(rj.jwt.headers['alg']),
-                                           owner=owner)
+        keys = self.keyjar.get_verify_key(jws.alg2keytype(rj.jwt.headers['alg']), owner=owner)
         return rj.verify_compact(token, keys)
 
     def _decrypt(self, rj, token):

tests/test_jwt.py

@@ -2,6 +2,7 @@
 
 from oic.utils.jwt import JWT
 from oic.utils.keyio import build_keyjar
+from oic.utils.keyio import keybundle_from_local_file
 
 __author__ = 'roland'
 
@@ -36,3 +37,20 @@ def test_jwt_pack_and_unpack():
     info = srv.unpack(_jwt)
 
     assert _eq(info.keys(), ['jti', 'iat', 'exp', 'iss', 'sub', 'kid'])
+
+
+class TestJWT(object):
+    """Tests for JWT."""
+
+    def test_unpack_verify_key(self):
+        srv = JWT(keyjar, iss=issuer)
+        _jwt = srv.pack(sub="sub")
+        # Remove the signing key from keyjar
+        keyjar.remove_key("", "RSA", "")
+        # And add it back as verify
+        kb = keybundle_from_local_file(os.path.join(BASE_PATH, "cert.key"), "RSA", ["ver"])
+        # keybundle_from_local_file doesn'assign kid, so assign manually
+        kb._keys[0].kid = kidd["sig"]["RSA"]
+        keyjar.add_kb("", kb)
+        info = srv.unpack(_jwt)
+        assert info["sub"] == "sub"