driver: Use proper key name when JWT is enabled

Makefile

@@ -24,7 +24,13 @@ test-resetdb:
 		docker rm -f hydra_test_database_mysql || true
 		docker rm -f hydra_test_database_postgres || true
 		docker run --rm --name hydra_test_database_mysql -p 3444:3306 -e MYSQL_ROOT_PASSWORD=secret -d mysql:5.7
-		docker run --rm --name hydra_test_database_postgres -p 3445:5432 -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=hydra -d postgres:9.6
+		docker run --rm --name hydra_test_database_postgres -p 3445:5432 -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=hydra -d postgres:9.
+
+# Runs tests in short mode, without database adapters
+.PHONY: docker
+docker:
+		GO111MODULE=on GOOS=linux GOARCH=amd64 go build && docker build -t oryd/hydra:latest .
+		rm hydra
 
 # Runs tests in short mode, without database adapters
 .PHONY: quicktest

driver/configuration/provider_viper.go

@@ -92,7 +92,7 @@ func (v *ViperProvider) InsecureRedirects() []string {
 
 func (v *ViperProvider) WellKnownKeys(include ...string) []string {
 	if v.AccessTokenStrategy() == "jwt" {
-		include = append(include, x.OpenIDConnectKeyName)
+		include = append(include, x.OAuth2JWTKeyName)
 	}
 
 	include = append(include, x.OpenIDConnectKeyName)
@@ -125,9 +125,13 @@ func (v *ViperProvider) SubjectTypesSupported() []string {
 
 	if stringslice.Has(types, "pairwise") {
 		if v.AccessTokenStrategy() == "jwt" {
-			v.l.Fatalf(`The pairwise subject identifier algorithm is not supported by the JWT OAuth 2.0 Access Token Strategy. Please remove "pairwise" from oidc.subject_identifiers.supported or set strategies.access_token to "opaque".`)
-		}
-		if len(v.SubjectIdentifierAlgorithmSalt()) < 8 {
+			v.l.Warn(`The pairwise subject identifier algorithm is not supported by the JWT OAuth 2.0 Access Token Strategy and is thus being disabled. Please remove "pairwise" from oidc.subject_identifiers.enable" (e.g. oidc.subject_identifiers.enable=public) or set strategies.access_token to "opaque".`)
+			types = stringslice.Filter(types,
+				func(s string) bool {
+					return !(s == "public")
+				},
+			)
+		} else if len(v.SubjectIdentifierAlgorithmSalt()) < 8 {
 			v.l.Fatalf(`The pairwise subject identifier algorithm was set but length of oidc.subject_identifier.salt is too small (%d < 8), please set oidc.subject_identifiers.pairwise.salt to a random string with 8 characters or more.`, len(v.SubjectIdentifierAlgorithmSalt()))
 		}
 	}

driver/configuration/provider_viper_test.go

@@ -34,6 +34,15 @@ func TestSubjectTypesSupported(t *testing.T) {
 			c: setEnv(strings.ToUpper(strings.Replace(ViperKeySubjectTypesSupported, ".", "_", -1)), ""),
 			e: []string{"public", "pairwise"},
 		},
+		{
+			d: "Load legacy environment variable in legacy format",
+			p: func(t *testing.T) {
+				setEnv(strings.ToUpper(strings.Replace(ViperKeySubjectTypesSupported, ".", "_", -1)), "public,pairwise,foobar")(t)
+				setEnv(strings.ToUpper(strings.Replace(ViperKeyAccessTokenStrategy, ".", "_", -1)), "jwt")(t)
+			},
+			c: setEnv(strings.ToUpper(strings.Replace(ViperKeySubjectTypesSupported, ".", "_", -1)), ""),
+			e: []string{"public"},
+		},
 	} {
 		t.Run(fmt.Sprintf("case=%d/description=%s", k, tc.d), func(t *testing.T) {
 			tc.p(t)

quickstart-jwt.yml

@@ -0,0 +1,21 @@
+###########################################################################
+#######             FOR DEMONSTRATION PURPOSES ONLY                 #######
+###########################################################################
+#                                                                         #
+# If you have not yet read the tutorial, do so now:                       #
+#  https://www.ory.sh/docs/hydra/5min-tutorial                            #
+#                                                                         #
+# This set up is only for demonstration purposes. The login               #
+# endpoint can only be used if you follow the steps in the tutorial.      #
+#                                                                         #
+###########################################################################
+
+version: '3'
+
+services:
+
+  hydra:
+    environment:
+      - OAUTH2_ACCESS_TOKEN_STRATEGY=jwt
+      - OIDC_SUBJECT_IDENTIFIERS_ENABLED=public
+    restart: unless-stopped

quickstart.yml

@@ -32,7 +32,6 @@ services:
       - OAUTH2_SHARE_ERROR_DEBUG=1
       - OIDC_SUBJECT_TYPES_SUPPORTED=public,pairwise
       - OIDC_SUBJECT_TYPE_PAIRWISE_SALT=youReallyNeedToChangeThis
-#      - OAUTH2_ACCESS_TOKEN_STRATEGY=jwt
     restart: unless-stopped
 
   consent: