[
https://issues.apache.org/jira/browse/CAMEL-26532?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138134#comment-18138134
]
Claus Ibsen commented on CAMEL-26532:
-------------------------------------
Fixed on main via https://github.com/apache/camel/pull/29058 (fix version
4.24.0).
_Claude Code on behalf of davsclaus_
> camel-keycloak: KeycloakPublicKeyResolver should rate limit remote JWKS
> refresh on unknown kid
> ----------------------------------------------------------------------------------------------
>
> Key: CAMEL-26532
> URL: https://issues.apache.org/jira/browse/CAMEL-26532
> Project: Camel
> Issue Type: Improvement
> Components: camel-keycloak
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.24.0
>
>
> In KeycloakPublicKeyResolver, when getPublicKey(String kid) is called with a
> key ID (kid) that is not present in the local keyCache, it immediately
> triggers a synchronous refreshKeys() call to fetch keys from the Keycloak
> server JWKS endpoint.
> When incoming tokens contain unknown or rotated key IDs in rapid succession,
> this causes repetitive synchronous remote HTTP calls to the Keycloak certs
> endpoint and contention on the resolver lock. In addition, when the cache is
> initially empty, an incoming request with a kid triggers two consecutive
> refresh calls.
> KeycloakPublicKeyResolver should be improved to:
> 1. Rate limit or introduce a minimum cooldown interval between remote JWKS
> refreshes for unknown key IDs.
> 2. Avoid double refresh on initial token resolution when the cache is empty.
> 3. Keep existing cached public keys intact until new keys are successfully
> fetched and parsed.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
