There is a set of parties, each of whom have a public/private key. I have the public key for each of them.
These parties will send me JWTs signed with their private key. I do not know which party sent the JWT, so I need to check the JWT. If the signature matches for public key #1, I know it came from party #1.
I want a way to securely identify the party who sent the JWT.
The easiest but slowest way to do this is to check each public key until it matches.
The solution I have in mind involves matching the public key to the
iss field of the JWT. I can sneak a look in the JWT, without verifying the signature, extract the
iss claim, use that to decide which public key to use, and then use that to verify the signature.
I can't see any security holes in this approach, but needing two passes feels wrong. Is there a standard way to do this?