rmannibucau commented on code in PR #7:
URL: https://github.com/apache/geronimo-jwt-auth/pull/7#discussion_r1562539969
##########
src/main/java/org/apache/geronimo/microprofile/impl/jwtauth/jwt/KidMapper.java:
##########
@@ -79,9 +101,48 @@ private void init() {
.collect(Collectors.toSet()))
.orElseGet(HashSet::new);
ofNullable(config.read("issuer.default", config.read(Names.ISSUER,
null))).ifPresent(defaultIssuers::add);
+ jwksUrl = config.read("mp.jwt.verify.publickey.location", null);
+ readerFactory = Json.createReaderFactory(emptyMap());
+ ofNullable(jwksUrl).ifPresent(url -> {
+ HttpClient.Builder builder = HttpClient.newBuilder();
+ if (getJwksRefreshInterval() != null) {
+ long secondsRefresh = getJwksRefreshInterval();
+ backgroundThread =
Executors.newSingleThreadScheduledExecutor();
+ builder.executor(backgroundThread);
+ backgroundThread.scheduleAtFixedRate(this::reloadRemoteKeys,
getJwksRefreshInterval(), secondsRefresh, SECONDS);
+ }
+ httpClient = builder.build();
+ reloadJwksRequest = reloadRemoteKeys();// inital load, otherwise
the background thread is too slow to start and serve
+ });
defaultKey = config.read("public-key.default",
config.read(Names.VERIFIER_PUBLIC_KEY, null));
}
+ private Integer getJwksRefreshInterval() {
+ String interval = config.read("jwks.invalidation.interval",null);
+ if (interval != null) {
+ return Integer.parseInt(interval);
+ } else {
+ return null;
+ }
+ }
+
+ private CompletableFuture<Void> reloadRemoteKeys() {
+ HttpRequest request =
HttpRequest.newBuilder().GET().uri(URI.create(jwksUrl)).header("Accept",
"application/json").build();
+ CompletableFuture<HttpResponse<String>> httpResponseCompletableFuture
= httpClient.sendAsync(request, HttpResponse.BodyHandlers.ofString());
+ CompletableFuture<Void> ongoingRequest =
httpResponseCompletableFuture.thenApply(result -> {
+ List<JWK> jwks = parseKeys(result);
+ ConcurrentHashMap<String, String> newKeys = new
ConcurrentHashMap<>();
+ jwks.forEach(key -> newKeys.put(key.getKid(), key.toPemKey()));
+ keyMapping = newKeys;
+ return null;
+ });
+
+ ongoingRequest.thenRun(() -> {
Review Comment:
Hmm, sorry I'm not sure I understood: you will rework it as proposed cause
as of today the theRun does not do the intent nor runs in the http response
thread - it uses commonpool on hotspot and a specific cached thread pool on
openj9/IBM semuru.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
