robertpofuk opened a new pull request, #76467: URL: https://github.com/apache/airflow/pull/76467
When the issuer behind `[api_auth] trusted_jwks_url` rotates its signing key, every token signed with the new key is rejected with `Kid did not match any validation keys` until the keyset is refreshed. A remote keyset refreshes only once an hour. A local keyset file is read once and never again (the code had a note saying it "could be improved in future"), so a file written by a sidecar or init container keeps rejecting tokens until the API server restarts. What changes in `JWKS`: - A token whose `kid` is not in the keyset triggers an immediate reload. Reloads stay rate-limited by `refresh_retry_interval_secs`, so tokens with made-up key IDs cannot flood the issuer. - Concurrent requests that need a reload share one fetch and all use its result. Before, requests arriving while a fetch was in flight either started their own fetch (cold start) or were rejected because the retry interval had not elapsed (after a rotation). The lock is kept per event loop, since `validated_claims()` runs `avalidated_claims()` through `async_to_sync` on short-lived loops. - A local keyset file is reloaded on `refresh_interval_secs`, the same as a remote URL. - A reload that fails or returns no usable keys keeps the keyset loaded before, instead of raising. - New `default_algorithm`: sets `alg` on keys published without one. PingFederate, for example, publishes alg-less RSA keys but signs RS512, and PyJWT assumes RS256 for such keys. An algorithm PyJWT does not support, or `none`, is rejected when the `JWKS` is created, so a typo fails at startup rather than as a 403 on every request. - Keysets built with `JWKS.from_private_key` are never reloaded. New `[api_auth]` options: `trusted_jwks_refresh_interval` (3600), `trusted_jwks_refresh_retry_interval` (10) and `trusted_jwks_default_algorithm` (unset). The defaults match today's behaviour. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Opus 5.5 Generated-by: Claude Opus 5.5 following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
