Use RSA keys for openid token signing

crates/defguard/src/main.rs

@@ -94,12 +94,6 @@ async fn main() -> Result<(), anyhow::Error> {
     )
     .await;
 
-    if config.openid_signing_key.is_some() {
-        info!("Using RSA OpenID signing key");
-    } else {
-        info!("Using HMAC OpenID signing key");
-    }
-
     // initialize global settings struct
     initialize_current_settings(&pool).await?;
 
@@ -196,6 +190,13 @@ async fn main() -> Result<(), anyhow::Error> {
 
     let settings = Settings::get_current_settings();
 
+    #[allow(deprecated)]
+    if config.hmac {
+        info!("Using HMAC OpenID signing key (forced by deprecated config flag)");
+    } else {
+        info!("Using RSA OpenID signing key");
+    }
+
     // create event channels for services
     let (api_event_tx, api_event_rx) = unbounded_channel::<ApiEvent>();
     let (bidi_event_tx, bidi_event_rx) = unbounded_channel::<BidiStreamEvent>();

crates/defguard_common/src/config.rs

@@ -71,9 +71,17 @@ pub struct DefGuardConfig {
     pub grpc_key: Option<String>,
 
     #[arg(long, env = "DEFGUARD_OPENID_KEY", value_parser = Self::parse_openid_key)]
+    #[deprecated(since = "2.0.0", note = "Use auto-generated openid signing key")]
     #[serde(skip_serializing)]
     pub openid_signing_key: Option<RsaPrivateKey>,
 
+    #[arg(long, env = "DEFGUARD_HMAC", default_value_t = false)]
+    #[deprecated(
+        since = "2.0.0",
+        note = "Temporary compatibility flag for OpenID signing"
+    )]
+    pub hmac: bool,
+
     #[arg(long, env = "DEFGUARD_URL", value_parser = Url::parse)]
     #[serde(skip_serializing)]
     #[deprecated(since = "2.0.0", note = "Use Settings.defguard_url instead")]
@@ -261,6 +269,7 @@ impl DefGuardConfig {
             grpc_cert: None,
             grpc_key: None,
             openid_signing_key: None,
+            hmac: false,
             url: None,
             disable_stats_purge: None,
             stats_purge_frequency: None,
@@ -315,7 +324,9 @@ impl DefGuardConfig {
     }
 
     #[must_use]
+    #[deprecated(since = "2.0.0", note = "Use auto-generated openid signing key")]
     pub fn openid_key(&self) -> Option<CoreRsaPrivateSigningKey> {
+        #[allow(deprecated)]
         let key = self.openid_signing_key.as_ref()?;
         if let Ok(pem) = key.to_pkcs1_pem(LineEnding::default()) {
             let key_id = JsonWebKeyId::new(key.n().to_str_radix(36));