I am working with Elixir using the JOSE package. I have an ALB that is using the Authentication Listener rule, and the data I am getting in the x-amzn-oidc-data is supposed to be a JWT containing the user claims. However, while the value is mostly in JWT formatting, it is base64 URL encoded, but with padding. As such, JOSE is unable to verify most of the tokens coming in (if a token arrives without padding, JOSE verifies it no problem).

I thought I could fix this by simply stripping the = characters from the token in the header, payload and signature, however no combination of that seems to work.

I've used the jwt.io to try and debug the token, and it complains about the signature becoming invalid if I attempt to strip = characters from the payload (only?). However, I have tried validating the token using the Python JOSE library and the Javascript JOSE library, and both are able to. Again though, if I strip the padding characters from the payload, both those libraries tell me the signature verification fails. I have to leave it in for the signature to go through.

Is there a way to massage this token into a format that doesn't include the padding, and could be verified by the Elixir JOSE package? I've tried to reverse-engineer how these libraries are able to decode the tokens while others fail, but I haven't had any luck.

Just for a visual example, this is how the tokens should look

eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.tyh-VfuzIxCyGYDlkBA7DfyjrqmSHu6pQ2hoZuFqUSLPNY2N0mpHb3nk5K17HWP_3cYHBw7AhHale5wky6-sVA

but the ALB sends me things that look like (note the added padded characters in the payload and signature)

eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0==.tyh-VfuzIxCyGYDlkBA7DfyjrqmSHu6pQ2hoZuFqUSLPNY2N0mpHb3nk5K17HWP_3cYHBw7AhHale5wky6-sVA==