Getting a "Missing claim: identity" message when using RS256 with jti present

Hi, I was following the tutorial for creating and consuming JWT tokens using jwt_extended: https://codeburst.io/jwt-authorization-in-flask-c63c1acf4eeb https://github.com/oleg-agapov/flask-jwt-auth (Kudos for these docs - they worked perfectly and gave a quick intro!)

I now modified the code to adapt our use-case: We want to use SSO from Laravelle Framework to Flask. So tokens are generated from Laravelle and used by jwt_extended only using HTTP header with bearer token. HS256 works, but we need to use RS256 (given requirement). The changes work so far, but I always get a “Missing claim: identity” message.

The token has jti set and also in https://jwt.io/#debugger-io?… I can verify it’s there. Also decoding works as I just fixed the audience claim and now have the JTI issue. My decrypted JWT payload in dev looks like follows { "aud": "1", "jti": "c08997d33657aaeffb77968f724db7aa878c025006b69e56cf4ec04df49562870992a76cb33d42e6", "iat": 1564745708, "nbf": 1564745708, "exp": 1596368108, "sub": "1", "scopes": [], "user": { "id": 1, "account_id": 1, "creator_id": null, "login": "[e-mail]", "status": "created", "archived_at": null, "created_at": "2019-07-24 09:52:55", "updated_at": "2019-08-02 11:19:35" } }

Any hint would be appreciated. Although not optimal a workaround like declaring the claim optional would do it for now. THX.

Environment Infos: OsX 10.14 venv Python 3.6.5 Package Version

---

aniso8601 7.0.0
asn1crypto 0.24.0 cffi 1.12.3 Click 7.0
cryptography 2.7
Flask 1.1.1
Flask-JWT-Extended 3.20.0 Flask-RESTful 0.3.7
Flask-SQLAlchemy 2.4.0
itsdangerous 1.1.0
Jinja2 2.10.1 MarkupSafe 1.1.1
passlib 1.7.1
pip 19.2.1 pyasn1 0.4.6
pycparser 2.19
PyJWT 1.7.1
pytz 2019.1 rsa 4.0
setuptools 41.0.1 six 1.12.0 SQLAlchemy 1.3.6
Werkzeug 0.15.5 wheel 0.33.4

[vimalloc]

The JWT_IDENTITY_CLAIM should actually be 'sub' per the spec. By default, this extension looks for it as identity because that’s how I originally had it and didn’t want to cause a breaking change for users by changing it, but I do mention it in the docs that it is recommended to change it to sub.

You can do so via app.config['JWT_IDENTITY_CLAIM'] = 'sub' and I expect this would work for you.

[igorkf]

In my case I have to use iss.
In JSON Web Token Claims explains the different claims:

Reserved claims
The JWT specification defines seven reserved claims that are not required, but are recommended to allow interoperability with third-party applications. These are:

• iss (issuer): Issuer of the JWT
• sub (subject): Subject of the JWT (the user)
• aud (audience): Recipient for which the JWT is intended
• exp (expiration time): Time after which the JWT expires
• nbf (not before time): Time before which the JWT must not be accepted for processing
• iat (issued at time): Time at which the JWT was issued; can be used to determine age of the JWT
• jti (JWT ID): Unique identifier; can be used to prevent the JWT from being replayed (allows a token to be used only once)