pac4j cannot find matching kid

[Vivek P.Netha]

Hi we are on Druid version 33. Trying to setup SSO with Microsoft Entra ID using Pac4j. Getting this exception below.

HTTP ERROR 500 org.pac4j.core.exception.TechnicalException: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
URI:
/druid-ext/druid-pac4j/callback
STATUS:
500
MESSAGE:
org.pac4j.core.exception.TechnicalException: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
SERVLET:
org.eclipse.jetty.servlet.DefaultServlet-41bdaa81
CAUSED BY:
org.pac4j.core.exception.TechnicalException: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
CAUSED BY:
com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found  

With some Copilot analysis, this appears to be the root cause:

• Token kid (****) missing from default JWKS
• Entra app appears configured with app-specific tenant-scoped signing keys
• Token signed by /{tenant}/discovery/keys?appid={client_id}, while pac4j validates against /common/discovery/keys from discovery doc
• Result: pac4j cannot find matching kid → BadJOSEException

Any ideas on how to resolve this?

Thanks.