refactor!: RSA1_5 JWE encryption algorithm is no longer supported

BREAKING CHANGE: The RSA1_5 JWE Key Management Algorithm, which was previously disabled by default, is now completely removed.
panva · Dec 1, 2022 · a967a4e · a967a4e
1 parent 3575584
commit a967a4e
Show file tree

Hide file tree

Showing 7 changed files with 66 additions and 67 deletions.
diff --git a/docs/README.md b/docs/README.md
@@ -1807,7 +1807,7 @@ async function getResourceServerInfo(ctx, resourceIndicator, client) {
        },
     // Tokens will be encrypted
     encrypt?: {
-      alg: string, // 'dir' | 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA-OAEP-384' | 'RSA-OAEP-512' | 'RSA1_5' | 'ECDH-ES' | 'ECDH-ES+A128KW' | 'ECDH-ES+A192KW' | 'ECDH-ES+A256KW' | 'A128KW' | 'A192KW' | 'A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW'
+      alg: string, // 'dir' | 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA-OAEP-384' | 'RSA-OAEP-512' | 'ECDH-ES' | 'ECDH-ES+A128KW' | 'ECDH-ES+A192KW' | 'ECDH-ES+A256KW' | 'A128KW' | 'A192KW' | 'A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW'
       enc: string, // 'A128CBC-HS256' | 'A128GCM' | 'A192CBC-HS384' | 'A192GCM' | 'A256CBC-HS512' | 'A256GCM'
       key: crypto.KeyObject | Buffer, // public key or shared symmetric secret to encrypt the JWT token with
       kid?: string, // OPTIONAL `kid` JOSE Header Parameter to put in the token's JWE Header
@@ -3024,7 +3024,7 @@ _**default value**_:
 ```js
 [
   // asymmetric RSAES based
-  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
   // asymmetric ECDH-ES based
   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
   // symmetric AES key wrapping
@@ -3170,7 +3170,7 @@ _**default value**_:
 ```js
 [
   // asymmetric RSAES based
-  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
   // asymmetric ECDH-ES based
   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
   // symmetric AES key wrapping
@@ -3258,7 +3258,7 @@ _**default value**_:
 ```js
 [
   // asymmetric RSAES based
-  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
   // asymmetric ECDH-ES based
   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
   // symmetric AES key wrapping
@@ -3346,7 +3346,7 @@ _**default value**_:
 ```js
 [
   // asymmetric RSAES based
-  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
   // asymmetric ECDH-ES based
   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
   // symmetric AES key wrapping
@@ -3435,7 +3435,7 @@ _**default value**_:
 ```js
 [
   // asymmetric RSAES based
-  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+  'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
   // asymmetric ECDH-ES based
   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
   // symmetric AES key wrapping

diff --git a/lib/consts/jwa.js b/lib/consts/jwa.js
@@ -10,7 +10,6 @@ const encryptionAlgValues = [
   // asymmetric
   'RSA-OAEP',
   'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
-  'RSA1_5',
   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
   // symmetric
   'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',

diff --git a/lib/helpers/defaults.js b/lib/helpers/defaults.js
@@ -1697,7 +1697,7 @@ function makeDefaults() {
          *        },
          *     // Tokens will be encrypted
          *     encrypt?: {
-         *       alg: string, // 'dir' | 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA-OAEP-384' | 'RSA-OAEP-512' | 'RSA1_5' | 'ECDH-ES' | 'ECDH-ES+A128KW' | 'ECDH-ES+A192KW' | 'ECDH-ES+A256KW' | 'A128KW' | 'A192KW' | 'A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW'
+         *       alg: string, // 'dir' | 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA-OAEP-384' | 'RSA-OAEP-512' | 'ECDH-ES' | 'ECDH-ES+A128KW' | 'ECDH-ES+A192KW' | 'ECDH-ES+A256KW' | 'A128KW' | 'A192KW' | 'A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW'
          *       enc: string, // 'A128CBC-HS256' | 'A128GCM' | 'A192CBC-HS384' | 'A192GCM' | 'A256CBC-HS512' | 'A256GCM'
          *       key: crypto.KeyObject | Buffer, // public key or shared symmetric secret to encrypt the JWT token with
          *       kid?: string, // OPTIONAL `kid` JOSE Header Parameter to put in the token's JWE Header
@@ -2476,7 +2476,7 @@ function makeDefaults() {
        * ```js
        * [
        *   // asymmetric RSAES based
-       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
        *   // asymmetric ECDH-ES based
        *   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
        *   // symmetric AES key wrapping
@@ -2499,7 +2499,7 @@ function makeDefaults() {
        * ```js
        * [
        *   // asymmetric RSAES based
-       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
        *   // asymmetric ECDH-ES based
        *   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
        *   // symmetric AES key wrapping
@@ -2522,7 +2522,7 @@ function makeDefaults() {
        * ```js
        * [
        *   // asymmetric RSAES based
-       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
        *   // asymmetric ECDH-ES based
        *   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
        *   // symmetric AES key wrapping
@@ -2546,7 +2546,7 @@ function makeDefaults() {
        * ```js
        * [
        *   // asymmetric RSAES based
-       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
        *   // asymmetric ECDH-ES based
        *   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
        *   // symmetric AES key wrapping
@@ -2570,7 +2570,7 @@ function makeDefaults() {
        * ```js
        * [
        *   // asymmetric RSAES based
-       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5',
+       *   'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
        *   // asymmetric ECDH-ES based
        *   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
        *   // symmetric AES key wrapping

diff --git a/lib/helpers/initialize_keystore.js b/lib/helpers/initialize_keystore.js
@@ -95,7 +95,7 @@ const jwkEncryptionAlgorithms = (jwk) => {
 
   switch (jwk.kty) {
     case 'RSA':
-      available = ['RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5'];
+      available = ['RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512'];
       break;
     case 'EC':
       switch (jwk.crv) {

diff --git a/test/configuration/client_metadata.test.js b/test/configuration/client_metadata.test.js
@@ -738,7 +738,7 @@ describe('Client metadata validation', () => {
       }));
       allows(this.title, 'dir', undefined, configuration);
       [
-        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
+        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
         'ECDH-ES+A256KW', 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
       ].forEach((value) => {
         allows(this.title, value, {
@@ -752,26 +752,26 @@ describe('Client metadata validation', () => {
     context('id_token_encrypted_response_enc', function () {
       defaultsTo(this.title, undefined);
       defaultsTo(this.title, 'A128CBC-HS256', {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
       mustBeString(this.title, undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
       [
         'A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM',
       ].forEach((value) => {
         allows(this.title, value, {
-          [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+          [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
           jwks: { keys: [sigKey] },
         }, configuration);
         allows(this.title, value, {
           [this.title.replace(/(enc$)/, 'alg')]: 'dir',
         }, configuration);
       });
       rejects(this.title, 'not-an-enc', undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
     });
@@ -791,7 +791,7 @@ describe('Client metadata validation', () => {
       }));
       allows(this.title, 'dir', undefined, configuration);
       [
-        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
+        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
         'ECDH-ES+A256KW', 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
       ].forEach((value) => {
         allows(this.title, value, {
@@ -806,26 +806,26 @@ describe('Client metadata validation', () => {
       defaultsTo(this.title, undefined);
       defaultsTo(this.title, undefined, undefined, configuration);
       defaultsTo(this.title, 'A128CBC-HS256', {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
       mustBeString(this.title, undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
       [
         'A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM',
       ].forEach((value) => {
         allows(this.title, value, {
-          [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+          [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
           jwks: { keys: [sigKey] },
         }, configuration);
         allows(this.title, value, {
           [this.title.replace(/(enc$)/, 'alg')]: 'dir',
         }, configuration);
       });
       rejects(this.title, 'not-an-enc', undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
     });
@@ -845,7 +845,7 @@ describe('Client metadata validation', () => {
       }));
       allows(this.title, 'dir', undefined, configuration);
       [
-        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
+        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
         'ECDH-ES+A256KW', 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
       ].forEach((value) => {
         allows(this.title, value, {
@@ -860,26 +860,26 @@ describe('Client metadata validation', () => {
       defaultsTo(this.title, undefined);
       defaultsTo(this.title, undefined, undefined, configuration);
       defaultsTo(this.title, 'A128CBC-HS256', {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
       mustBeString(this.title, undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
       [
         'A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM',
       ].forEach((value) => {
         allows(this.title, value, {
-          [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+          [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
           jwks: { keys: [sigKey] },
         }, configuration);
         allows(this.title, value, {
           [this.title.replace(/(enc$)/, 'alg')]: 'dir',
         }, configuration);
       });
       rejects(this.title, 'not-an-enc', undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
     });
@@ -899,7 +899,7 @@ describe('Client metadata validation', () => {
       }));
       allows(this.title, 'dir', undefined, configuration);
       [
-        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
+        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
         'ECDH-ES+A256KW', 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
       ].forEach((value) => {
         allows(this.title, value, {
@@ -914,26 +914,26 @@ describe('Client metadata validation', () => {
       defaultsTo(this.title, undefined);
       defaultsTo(this.title, undefined, undefined, configuration);
       defaultsTo(this.title, 'A128CBC-HS256', {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
       mustBeString(this.title, undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
       [
         'A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM',
       ].forEach((value) => {
         allows(this.title, value, {
-          [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+          [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
           jwks: { keys: [sigKey] },
         }, configuration);
         allows(this.title, value, {
           [this.title.replace(/(enc$)/, 'alg')]: 'dir',
         }, configuration);
       });
       rejects(this.title, 'not-an-enc', undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         jwks: { keys: [sigKey] },
       }, configuration);
     });
@@ -959,7 +959,7 @@ describe('Client metadata validation', () => {
       }));
       allows(this.title, 'dir', undefined, configuration);
       [
-        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
+        'RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW',
         'ECDH-ES+A256KW', 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
       ].forEach((value) => {
         allows(this.title, value, undefined, configuration);
@@ -972,23 +972,23 @@ describe('Client metadata validation', () => {
       defaultsTo(this.title, undefined);
       defaultsTo(this.title, undefined, undefined, configuration);
       defaultsTo(this.title, 'A128CBC-HS256', {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
       }, configuration);
       mustBeString(this.title, undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
       }, configuration);
       [
         'A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM',
       ].forEach((value) => {
         allows(this.title, value, {
-          [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+          [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
         }, configuration);
         allows(this.title, value, {
           [this.title.replace(/(enc$)/, 'alg')]: 'dir',
         }, configuration);
       });
       rejects(this.title, 'not-an-enc', undefined, {
-        [this.title.replace(/(enc$)/, 'alg')]: 'RSA1_5',
+        [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
       }, configuration);
     });
   });
@@ -1173,7 +1173,7 @@ describe('Client metadata validation', () => {
       'introspection_encrypted_response_alg',
     ].forEach((prop) => {
       [
-        'RSA-OAEP', 'RSA1_5',
+        'RSA-OAEP',
         'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
       ].forEach((alg) => {
         rejects(this.title, undefined, 'jwks or jwks_uri is mandatory for this client', {

diff --git a/test/encryption/encryption.config.js b/test/encryption/encryption.config.js
@@ -15,7 +15,7 @@ merge(config.features, {
   pushedAuthorizationRequests: { enabled: true },
 });
 
-pull(config.enabledJWA.requestObjectEncryptionAlgValues, 'RSA-OAEP');
+pull(config.enabledJWA.requestObjectEncryptionAlgValues, 'RSA-OAEP-512');
 pull(config.enabledJWA.requestObjectEncryptionEncValues, 'A192CBC-HS384');
 
 const k = jose.JWK.generateSync('RSA', 2048);
@@ -38,11 +38,11 @@ export default {
       response_types: ['id_token token', 'code'],
       grant_types: ['implicit', 'authorization_code'],
       jwks: pubKey,
-      id_token_encrypted_response_alg: 'RSA1_5',
+      id_token_encrypted_response_alg: 'RSA-OAEP',
       // id_token_encrypted_response_enc: 'A128CBC-HS256',
-      request_object_encryption_alg: 'RSA1_5',
+      request_object_encryption_alg: 'RSA-OAEP',
       // request_object_encryption_enc: 'A128CBC-HS256',
-      userinfo_encrypted_response_alg: 'RSA1_5',
+      userinfo_encrypted_response_alg: 'RSA-OAEP',
       // userinfo_encrypted_response_enc: 'A128CBC-HS256',
     },
     {