Ambiguous handling of multiple keys when allow_missing_kid and no_kid_issuer are not set

[lionick]

In the _add_key method, when multiple keys (_add_keys) are retrieved for an issuer but neither allow_missing_kid is True nor no_kid_issuer is provided for the issuer, the function does not add any keys to the keys list. This situation leads to silent failure, with no keys added.

Here is the part of the code:
https://github.com/IdentityPython/JWTConnect-Python-CryptoJWT/blob/main/src/cryptojwt/key_jar.py#L491

[c00kiemon5ter]

@rohe @jschlyter can you please check this report? It looks like a bug.

[rohe]

You will fall through the tests if you don't provide a kid and you don't allow a missing kid.
Something that looks perfectly reasonable.

@lionick Are you objecting to the silent failure ?

[lionick]

The problem is when the issuer has more than one key stored. Shouldn't it somehow retrieve all the keys rather than return no keys at all, or am I missing something?

[rohe]

If you want all keys and don't care about with kid they have, can't you just set allow_missing_kid to True ?

As it is the code is a bit picky about whether you provide a kid or not.
The expected default behaviour is that you know which kid you are looking for.
If you don't know the kid, that's a special case.

Is it problematic for you to set allow_missing_kid to True ?
It's that or we need to change the default behaviour.