oscerd opened a new pull request, #29058: URL: https://github.com/apache/camel/pull/29058
# Description In `KeycloakPublicKeyResolver`, when `getPublicKey(String kid)` encounters a `kid` that is not in `keyCache`, it previously triggered an immediate synchronous remote HTTP fetch to Keycloak's JWKS endpoint on every request. This PR improves `KeycloakPublicKeyResolver` and `KeycloakSecurityPolicy`: - Adds `minRefreshIntervalMs` (cooldown) in `KeycloakPublicKeyResolver` to rate limit remote JWKS refreshes when unknown key IDs are processed. - Fixes the initial key lookup to prevent duplicate refresh calls when the key cache is initially empty. - Ensures existing cached public keys remain intact if a subsequent JWKS response fails or contains no valid signature keys. - Adds `jwksRefreshInterval` (default 300s) and `minJwksRefreshInterval` (default 10s) configuration options to `KeycloakSecurityPolicy`. - Adds unit tests verifying that remote JWKS refreshes are throttled within the cooldown window and permitted after cooldown. # Tracking - Issue: https://issues.apache.org/jira/browse/CAMEL-26532 _Antigravity on behalf of Andrea Cosentino_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
