Support XML DSIG alg values

Some libraries use XML DSIG alg values in the jwt header (mostly .net standard library) instead of the standard JWS alg. meaning that instead of using "alg": "RS256" they’re using "alg": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256". Because of that I can’t use this library to parse and validate tokens generated by these libraries. It’s a pretty small fix to add this value table (located here https://datatracker.ietf.org/doc/html/rfc7518#appendix-A.1) to the enum to add support for it.

[lhazlewood]

@ronzeidman #493 is actually already implemented in the jwe branch, and I’m working hard to finish that as soon as I’m able. It has taken a year of on/off work, but I’ve dedicated a lot of time in the last three weeks to it, so I hope to have it finished within a month. The tricky part of all of this is that JWE requires encoded keys in the JWK format, and that was a whole 'nuther (fairly large) specification that had to be implemented just for JWE to be spec-compliant. It was a ton of work.

As to modifying the enum, that wouldn’t really work - because the interface-based approach is the only solution that allows plugging in of custom algorithms (with XML DSIG ID’s or otherwise), the enum has already been deprecated in the jwe branch. We don’t want to modify/add to the enum because we explicitly want to discourage its further use.

I very much appreciate you asking here first before working on a PR! We’re very grateful for PRs, but really hate having to decline them because the requestor wasn’t aware of current changes or codebase design issues (like the jwe work for example).

You might want to fork the latest JJWT release and add those changes locally for yourself until the jwe branch is merged if you need it before the jwe work is done - could be a month or so before we can merge it.

[stale[bot]]

Closed due to inactivity.