def test_oauth_user_info_authentik_with_jwt_validation_wrong_signature(self):
        """
        Tests if the get_user_info raises an exception
        if the token is signed by a different JKWS
        """
        self.app.config["OAUTH_PROVIDERS"] = [
            {
                "name": "authentik",
                "token_key": "access_token",
                "icon": "fa-fingerprint",
                "remote_app": {
                    "api_base_url": "https://authentik.mydomain.com",
                    "client_kwargs": {
                        "scope": "email profile",
                        "verify_signature": True,
                    },
                    "access_token_url": (
                        "https://authentik.mydomain.com" "/application/o/token/"
                    ),
                    "authorize_url": (
                        "https://authentik.mydomain.com/" "application/o/authorize/"
                    ),
                    "request_token_url": None,
                    "client_id": "CLIENT_ID",
                    "client_secret": "CLIENT_SECRET",
                    "jwks_uri": (
                        "https://authentik.mydomain.com/"
                        "application/o/APPLICATION_NAME/jwks/"
                    ),
                },
            },
        ]

        self.appbuilder = AppBuilder(self.app, self.db.session)
        claims = {
            "iss": "https://authentik.mydomain.com/application/o/flask-appbuilder-test/",
            "sub": "2ac1102e7cf5a4b1cb2dd5adbe4761c551691ecd88991f78d0195d4d3d0cfcfa",
            "aud": "CLIENT_ID",
            "exp": 1703257941,
            "iat": 1700665941,
            "auth_time": 7282182129,  # 100 years from now ;)
            "acr": "goauthentik.io/providers/oauth2/default",
            "at_hash": "cAydO2DJMi_ZL6opx3eUdw",
            "email": "alice@example.com",
            "email_verified": True,
            "name": "Alice",
            "given_name": "Alice Doe",
            "preferred_username": "alice@example.com",
            "nickname": "alice",
            "groups": ["GROUP_1", "GROUP_2"],
        }
        from unittest.mock import MagicMock

        private_key = """-----BEGIN PRIVATE KEY-----
MIIBVAIBADANBgkqhkiG9w0BAQEFAASCAT4wggE6AgEAAkEAqPfgaTEWEP3S9w0t
gsicURfo+nLW09/0KfOPinhYZ4ouzU+3xC4pSlEp8Ut9FgL0AgqNslNaK34Kq+NZ
jO9DAQIDAQABAkAgkuLEHLaqkWhLgNKagSajeobLS3rPT0Agm0f7k55FXVt743hw
Ngkp98bMNrzy9AQ1mJGbQZGrpr4c8ZAx3aRNAiEAoxK/MgGeeLui385KJ7ZOYktj
hLBNAB69fKwTZFsUNh0CIQEJQRpFCcydunv2bENcN/oBTRw39E8GNv2pIcNxZkcb
NQIgbYSzn3Py6AasNj6nEtCfB+i1p3F35TK/87DlPSrmAgkCIQDJLhFoj1gbwRbH
/bDRPrtlRUDDx44wHoEhSDRdy77eiQIgE6z/k6I+ChN1LLttwX0galITxmAYrOBh
BVl433tgTTQ=
-----END PRIVATE KEY-----"""
        # Create a signed JWT
        wrong_signed_jwt = jwt.encode(
            claims, key=private_key, algorithm="RS256", headers={"kid": "1"}
        )
        self.appbuilder.sm._get_authentik_jwks = MagicMock(
            return_value={
                "keys": [
                    {
                        "alg": "RS256",
                        "e": "AQAB",
                        "kid": "1",
                        "kty": "RSA",
                        "n": "t4OiMSRr3ddn8nxsMaCfYwgfKRp-ALHYPrBNmCaaHOlEfv-"
                        "Tsn9ZKyobp5IWDfyYYm6Q8Jrh1wbx0IuZ5qMR_aDgihpiITnnJezSi7-"
                        "2LEEkjzBFj418KW7GAhwd0qFkhJU7oKRHmvt2I39Isc-wWcN3RSIwnlz"
                        "jxSwnCTxPlPs",
                        "use": "sig",
                        "x5c": [
                            "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3g6IxJGvd12fyfGwxoJ9"
                            "jCB8pGn4Asdg+sE2YJpoc6UR+/5Oyf1krKhunkhYN/JhibpDwmuHXBvHQi5n"
                            "moxH9oOCKGmIhOecl7NKLv7YsQSSPMEWPjXwpbsYCHB3SoWSElTugpEea+3Y"
                            "jf0ixz7BZw3dFIjCeXOPFLCcJPE+U+wIDAQAB"
                        ],
                    }
                ]
            }
        )
        with self.assertRaises(BadSignatureError):
            self.appbuilder.sm.get_oauth_user_info(
                "authentik", {"access_token": "", "id_token": wrong_signed_jwt}
            )

        Tests if the get_user_info raises an exception
        if the token is signed by a different JKWS
        
tests/security/test_auth_oauth.py