[
https://issues.apache.org/jira/browse/KNOX-3515?focusedWorklogId=1048007&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1048007
]
ASF GitHub Bot logged work on KNOX-3515:
----------------------------------------
Author: ASF GitHub Bot
Created on: 17/Oct/26 08:46
Start Date: 17/Oct/26 08:46
Worklog Time Spent: 10m
Work Description: smolnar82 commented on PR #1456:
URL: https://github.com/apache/knox/pull/1456#issuecomment-6231914935
> Thanks Sandor. It looks good to me. In a normal production state,
refreshing the cache after ttl/2 makes sense. I'm concerned if there are
problems with the LB or in a test environment if one node might be idle for a
while and then test startup might see failures for the first few queries until
it starts to work. Possibly this is fine, just warm before test, and simpler
than an active poll. I'm not sure how much harder an active poll would be.
I think we can investigate that in the scope of a follow-up JIRA.
I'll read your comments and submit a new patchset soon.
Issue Time Tracking
-------------------
Worklog Id: (was: 1048007)
Time Spent: 1.5h (was: 1h 20m)
> Add trusted oidc issuer cache TTL/eventual consistency for HA configurations
> ----------------------------------------------------------------------------
>
> Key: KNOX-3515
> URL: https://issues.apache.org/jira/browse/KNOX-3515
> Project: Apache Knox
> Issue Type: Sub-task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Assignee: Sandor Molnar
> Priority: Major
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> Knox nodes in an HA configuration will not all see changes made on other
> nodes within a known time limit, and some will never be updated.
> Currently there are a few cache layers used with Trusted OIDC Issuers:
> # Registry snapshot in JdbcTrustedOidcIssuerService
> # Discovery document cache in OIDCDiscoveryHelper
> # JWKS source cache in DefaultTokenAuthorityService (this is preexisting)
> The registry snapshot never expires and is only mutated by the local admin
> API calls. See reloadRegistrySnapshot. The discovery document cache has a
> TTL, but won't be invalidated when the table data is changed.
> To enable HA configurations to work properly, the registry snapshot needs to
> be invalidated within a configurable time limit, ideally by a
> background/scheduled thread with jitter. This will be the same as the
> revocation timeout and the time before a newly registered issuer can be
> safely used for token exchange.
> To make the full cache stack work, when the registry snapshot cache is
> invalidated, the discovery cache must also be invalidated:
> discoveryHelper.invalidate(issuerUrl).
> There are other options to allow HA configurations to work, but they have
> drawbacks, including but not limited to:
> # Removing the registry cache exposes a DOS surface for invalid issuers
> ## Could use a negative cache with rate limiting to mitigate the DOS threat
> # One could optimize for reducing add issuer staleness: on issuer not found,
> have a faster interval to read through to the database. Likely would still
> need rate limiting.
> # Operator could call each node in the HA set. This is prone to error and
> may not be possible if the operator is not colocated in the cluster.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
