We are implementing OAuth PKCE flow and we would like to choose a specific signing algorithm for an access token (JWT). Since access token is generated and signed at authentication service, the obvious answer is to configure the service. I'm however curious if it's possible to also select the algorithm from client when requesting the access token, because i think the server announces multiple available signing algorithms in it's metainformation manifest (userinfo_signing_alg_values_supported). Our authentication service is Apereo CAS and the client is Nuxt Auth module.
I couldn't find any mention of such feature in Nuxt Auth documentation, but I would like to know if it's an architectural or just implementation limitation.
Motivation: we have a bug in one of the backends preventing the correct JWT validation and we suspect it's triggered by the exact combination of crypto actions contained in default signature algorithm our authentication service gives us. We would like to try another algorithm to confirm this hypothesis (and keep it if it works). We are however in corporate environment where change on both sides (backend libraries-auth service) is very difficult even for testing environment so I'm looking for an easier way through configuration. The bug has exactly these symptoms https://github.com/spring-attic/spring-security-oauth/issues/1052 but is probably triggered by different, not yet fixed cause.