smolnar82 commented on code in PR #1319:
URL: https://github.com/apache/knox/pull/1319#discussion_r3636781768
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/JdbcTrustedOidcIssuerService.java:
##########
@@ -195,6 +202,35 @@ private synchronized void reloadRegistrySnapshot() {
registrySnapshot.set(Collections.unmodifiableMap(fresh));
} catch (Exception e) {
LOG.errorReloadingRegistrySnapshot(e.getMessage(), e);
+ throw new RuntimeException("Error reloading trusted OIDC issuer registry
snapshot", e);
}
}
+
+ /**
+ * Canonicalizes an issuer URL for registry storage and lookup by stripping
a single
+ * trailing slash, so that {@code https://issuer.example.com/} and
+ * {@code https://issuer.example.com} are treated as the same issuer. This
matches the
+ * trailing-slash stripping {@link OIDCDiscoveryHelper} already applies when
building the
+ * discovery URL. Null-safe.
+ */
+ private static String normalizeIssuerUrl(String issuerUrl) {
Review Comment:
I'm fine with this as long as we understood that there might be a possible
mismatch while verifying the issuer claim in the JWT for a trusted issuer. Let
me close this one and merge #1320 .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
