ArneLimburg commented on code in PR #7:
URL: https://github.com/apache/geronimo-jwt-auth/pull/7#discussion_r1562571073
##########
src/main/java/org/apache/geronimo/microprofile/impl/jwtauth/jwt/KidMapper.java:
##########
@@ -79,9 +101,48 @@ private void init() {
.collect(Collectors.toSet()))
.orElseGet(HashSet::new);
ofNullable(config.read("issuer.default", config.read(Names.ISSUER,
null))).ifPresent(defaultIssuers::add);
+ jwksUrl = config.read("mp.jwt.verify.publickey.location", null);
+ readerFactory = Json.createReaderFactory(emptyMap());
+ ofNullable(jwksUrl).ifPresent(url -> {
+ HttpClient.Builder builder = HttpClient.newBuilder();
+ if (getJwksRefreshInterval() != null) {
+ long secondsRefresh = getJwksRefreshInterval();
+ backgroundThread =
Executors.newSingleThreadScheduledExecutor();
+ builder.executor(backgroundThread);
+ backgroundThread.scheduleAtFixedRate(this::reloadRemoteKeys,
getJwksRefreshInterval(), secondsRefresh, SECONDS);
+ }
+ httpClient = builder.build();
+ reloadJwksRequest = reloadRemoteKeys();// inital load, otherwise
the background thread is too slow to start and serve
+ });
defaultKey = config.read("public-key.default",
config.read(Names.VERIFIER_PUBLIC_KEY, null));
}
+ private Integer getJwksRefreshInterval() {
+ String interval = config.read("jwks.invalidation.interval",null);
+ if (interval != null) {
+ return Integer.parseInt(interval);
+ } else {
+ return null;
+ }
+ }
+
+ private CompletableFuture<Void> reloadRemoteKeys() {
+ HttpRequest request =
HttpRequest.newBuilder().GET().uri(URI.create(jwksUrl)).header("Accept",
"application/json").build();
+ CompletableFuture<HttpResponse<String>> httpResponseCompletableFuture
= httpClient.sendAsync(request, HttpResponse.BodyHandlers.ofString());
+ CompletableFuture<Void> ongoingRequest =
httpResponseCompletableFuture.thenApply(result -> {
+ List<JWK> jwks = parseKeys(result);
+ ConcurrentHashMap<String, String> newKeys = new
ConcurrentHashMap<>();
+ jwks.forEach(key -> newKeys.put(key.getKid(), key.toPemKey()));
+ keyMapping = newKeys;
+ return null;
+ });
+
+ ongoingRequest.thenRun(() -> {
Review Comment:
I think, I got the thread-pool handling wrong, so I will rework.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscr...@geronimo.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
