Signing JWT based on the default keyId. Currently, it signs based on the first key which has the desired algorithm.

openid-connect-client/src/main/java/org/mitre/openid/connect/client/OIDCAuthenticationFilter.java

@@ -425,6 +425,9 @@ public class OIDCAuthenticationFilter extends AbstractAuthenticationProcessingFi
 						null, null);
 				SignedJWT jwt = new SignedJWT(header, claimsSet.build());
 
+				if (signer.getDefaultSignerKeyId() != null)
+					signer.signJwt(jwt);
+				else
 					signer.signJwt(jwt, alg);
 
 				form.add("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");