moresandeep commented on code in PR #1459:
URL: https://github.com/apache/knox/pull/1459#discussion_r4325130210
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityService.java:
##########
@@ -377,17 +380,26 @@ private JWKSource<SecurityContext> buildJwkSource(URL
jwksUrl, ResourceRetriever
final long outageTTL = config.getJwksOutageCacheTTL();
final long cacheTTL = config.getJwksCacheTimeToLive();
final long cacheTimeOut = config.getJwksCacheRefreshTimeout();
- final JWKSourceBuilder<SecurityContext> builder = retriever == null
- ? JWKSourceBuilder.create(jwksUrl)
- : JWKSourceBuilder.create(jwksUrl, retriever);
- return builder
+ final ResourceRetriever jwksRetriever = retriever == null ?
defaultResourceRetriever(jwksUrl) : retriever;
+ return JWKSourceBuilder.<SecurityContext>create(jwksUrl, jwksRetriever)
.cache(cacheTTL, cacheTimeOut)
.refreshAheadCache(true)
.retrying(true)
.outageTolerant(outageTTL)
.build();
}
+ /*
+ * The retriever Nimbus would build for a URL, except that its sockets carry
the JWKS host so
+ * HTTPS endpoint identification can run under the BouncyCastle FIPS
provider. See
+ * SetHostSSLSocketFactory. Timeouts and size limit match the Nimbus
defaults.
+ */
+ private static ResourceRetriever defaultResourceRetriever(URL jwksUrl) {
Review Comment:
We actuially gate this on FIPS so the actual socket setHost(String) only
exists on BCSSLSocket, for stock JSSE forUrl's decorator hands the socket back
untouched.
THis is also covered in testLeavesSocketWithoutSetHostUnchanged.
Plus we don't want this fix just for FIPS, we want this independent of
provider.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
