Done (not merged yet)

Hello,

I'm a bit confused with the way the keys used to validate the signature are parsed:

		foreach ( $keys['keys'] as $keyData ) {
			if ( $keyData['kty'] !== 'RSA' ) {
				// Dont know how to handle other types
				continue;
			}
			$modulus = sodium_base642bin( $keyData['n'], SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING );
			$exponent = sodium_base642bin( $keyData['e'], SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING );
			$key = PublicKeyLoader::loadPublicKey( [
				'e' => new BigInteger( $exponent, 256 ),
				'n' => new BigInteger( $modulus, 256 ),
			] );

			$res[$keyData['kid']] = new Key( $key->toString( 'pkcs8' ), $keyData['alg'] );
		}

https://github.com/wikimedia/mediawiki-extensions-TuleapIntegration/blob/3002953f2cc0cf47a58ec759a0bf1f835c4ea5aa/src/Provider/Tuleap.php#L168-L181

I'm a bit concerned with using phpseclib3 when we could use the openssl_ primitives to avoid relying on a userland RSA implementation. I took a look at the Firebase JWT package and there is a JWK::parseKeySet method that we could use to achieve that.

Yep, it is only supposed to be present since it is the unique ID of the user you authenticate.

All done except verifying sub claim. Not sure how to do that. As far as i see, sub is the resource owner ID, but we dont get then until after the AT has been verified, right?

Yes, actually i fogot to finish this, checking for 200 was just a stub