ArneLimburg commented on code in PR #7:
URL: https://github.com/apache/geronimo-jwt-auth/pull/7#discussion_r1562525740
##########
src/main/java/org/apache/geronimo/microprofile/impl/jwtauth/jwt/KidMapper.java:
##########
@@ -79,9 +101,48 @@ private void init() {
.collect(Collectors.toSet()))
.orElseGet(HashSet::new);
ofNullable(config.read("issuer.default", config.read(Names.ISSUER,
null))).ifPresent(defaultIssuers::add);
+ jwksUrl = config.read("mp.jwt.verify.publickey.location", null);
+ readerFactory = Json.createReaderFactory(emptyMap());
+ ofNullable(jwksUrl).ifPresent(url -> {
+ HttpClient.Builder builder = HttpClient.newBuilder();
+ if (getJwksRefreshInterval() != null) {
+ long secondsRefresh = getJwksRefreshInterval();
+ backgroundThread =
Executors.newSingleThreadScheduledExecutor();
+ builder.executor(backgroundThread);
+ backgroundThread.scheduleAtFixedRate(this::reloadRemoteKeys,
getJwksRefreshInterval(), secondsRefresh, SECONDS);
+ }
+ httpClient = builder.build();
+ reloadJwksRequest = reloadRemoteKeys();// inital load, otherwise
the background thread is too slow to start and serve
+ });
defaultKey = config.read("public-key.default",
config.read(Names.VERIFIER_PUBLIC_KEY, null));
}
+ private Integer getJwksRefreshInterval() {
+ String interval = config.read("jwks.invalidation.interval",null);
+ if (interval != null) {
+ return Integer.parseInt(interval);
+ } else {
+ return null;
+ }
+ }
+
+ private CompletableFuture<Void> reloadRemoteKeys() {
+ HttpRequest request =
HttpRequest.newBuilder().GET().uri(URI.create(jwksUrl)).header("Accept",
"application/json").build();
+ CompletableFuture<HttpResponse<String>> httpResponseCompletableFuture
= httpClient.sendAsync(request, HttpResponse.BodyHandlers.ofString());
+ CompletableFuture<Void> ongoingRequest =
httpResponseCompletableFuture.thenApply(result -> {
+ List<JWK> jwks = parseKeys(result);
+ ConcurrentHashMap<String, String> newKeys = new
ConcurrentHashMap<>();
+ jwks.forEach(key -> newKeys.put(key.getKid(), key.toPemKey()));
+ keyMapping = newKeys;
+ return null;
+ });
+
+ ongoingRequest.thenRun(() -> {
Review Comment:
Yes, we agree on the first point.
My intention was to alway use the `.get`, but ensure, that it only blocks in
the initial case. That written I removed the null-check in `tryLoad`.
`thenApply` and `thenRun` will run in the thread that handles the
HTTP-response, so it should be fine.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
