What does didn't find publicKey for kid error mean in Keycloak - keycloak

Question

What does didn't find publicKey for kid error mean in Keycloak
2021-07-24T09:36:22,992 INFO [http-nio-5555-exec-9] o.k.a.KeycloakDeployment: Loaded URLs from https://foo.baz.com/auth/realms/sso/.well-known/openid-configuration
2021-07-24T09:36:23,156 ERROR [http-nio-5555-exec-9] o.k.a.r.AdapterTokenVerifier: Didn't find publicKey for kid: a7GiJ8syCz3UYPMlVKmfWb9tfPYLxbz_j5xWOniokg8
2021-07-24T09:36:23,181 ERROR [http-nio-5555-exec-9] o.k.a.r.AdapterTokenVerifier: Didn't find publicKey for kid: a7GiJ8syCz3UYPMlVKmfWb9tfPYLxbz_j5xWOniokg8
2021-07-24T09:36:23,410 ERROR [http-nio-5555-exec-3] o.k.a.r.AdapterTokenVerifier: Didn't find publicKey for kid: a7GiJ8syCz3UYPMlVKmfWb9tfPYLxbz_j5xWOniokg8
2021-07-24T09:36:23,412 ERROR [http-nio-5555-exec-1] o.k.a.r.AdapterTokenVerifier: Didn't find publicKey for kid: a7GiJ8syCz3UYPMlVKmfWb9tfPYLxbz_j5xWOniokg8
2021-07-24T09:36:23,415 ERROR [http-nio-5555-exec-1] o.k.a.r.AdapterTokenVerifier: Didn't find publicKey for kid: a7GiJ8syCz3UYPMlVKmfWb9tfPYLxbz_j5xWOniokg8
2021-07-24T09:36:23,417 ERROR [http-nio-5555-exec-3] o.k.a.r.AdapterTokenVerifier: Didn't find publicKey for kid: a7GiJ8syCz3UYPMlVKmfWb9tfPYLxbz_j5xWOniokg8

Answer 1

The service is verifying the integrity of a JWT and it is failing.
The verification is done by recalculating the signature based on the JWT's header and body and comparing it with the signature that is presented in the JWT. If the calculated signature and the one that is in the JWT match, the JWT surely comes from the expected party and no 3rd party had modified it (although a 3rd party could see it!).
For generating the signature, in the case of the most common method, RS256, a key is required. This key should only be obtained from the issuer of the token to guarantee the correctness of the verification process. For this reason, the token only holds a reference id for that key in the kid field.
The default certs' URL in your case should be:
https://foo.baz.com/auth/realms/sso/protocol/openid-connect/certs
The response should hold a similar key array like the response of the Google's cert endpoint:
{
"keys": [
{
"kty": "RSA",
"alg": "RS256",
"e": "AQAB",
"n": "nQPB_WqGG18pjGSFGQwRLcZkcRojHHweN27mV1oTNeeH2quq5NvWibLEheiukVP60nXcGNpkP_PaycYahEfvAnJGLX_IscGAOJ67WWFs4M8wXHH6g2mTnalcAYgmpN1QDMVgz4NcWISXNTR-8FZfWgFN4LDZgK4f0wXOaJlh_Bzh-plPLJQUXyY7mZTEVsH8X3wg2fvV0Hxj_HudjgFlYPdDri1Oi4vI0wiKV4nJCRZ-INH3OIvPl-05WVjZ-XTSXdNjLNx35NM2Npcrr9VpZ8Xeg7pr0wjamqd_07xfEAdtFxsN6Ay6Ecz3k0onQP-6SLRCGLrMAxifziivmmafCQ",
"use": "sig",
"kid": "7f548f6708690c21120b0ab668caa079acbc2b2f"
},
{
"n": "psh4_fDTsNZ1JkC2BV6nsU7681neTu8D37bMwTzzT-hugnePDyLaR8a_2HnqJaABndr0793WQCkiDolIjX1wn0a6zTpdgCJL-vaFe2FqPg19TWsZ8O6oKZc_rtWu-mE8Po7RGzi9qPLv9FxJPbiGq_HnMUo0EG7J4sN3IuzbU--Wmuz8LWALwmfpE9CfOym8x5GdUzbDL1ltuC2zXCaxARDnPs6vKR6eW1MZgXqgQ6ZQO9FklH_b5WJYLBDmHAb6CguoeU-AozaoVrBHgkWoDkku7nMWoetULtgBP_tYtFM8zvJ9IDD6abZM0jl-bsHIm3XFz0MgAJ9FmPti9-iShQ",
"kty": "RSA",
"alg": "RS256",
"kid": "3df0a831e093fae1e24d77d47834405f95d17b54",
"e": "AQAB",
"use": "sig"
}
]
}
In a normal case, the kid from the JWT can be found in this response, so, with the value of the corresponding "n" field, the signature can be calculated. But in your case, the kid is not there.
Common problems in this case:
a new key was introduced in the keycloak realm and the kid is referencing the old one
the URL of the openid-configuration is not correct
there is a caching layer in front of keycloak, so the response of openid-configuration is not up to date
a compromised/3rd party modified token
refs: AdapterTokenVerifier
jwt.io