Andrea Cosentino created CAMEL-24902:
----------------------------------------
Summary: camel-keycloak: honor token expiry (exp) when caching
introspection results
Key: CAMEL-24902
URL: https://issues.apache.org/jira/browse/CAMEL-24902
Project: Camel
Issue Type: Improvement
Components: camel-keycloak
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
The Keycloak security policy ({{KeycloakSecurityPolicy}} /
{{KeycloakSecurityProcessor}}) supports OAuth 2.0 token introspection (RFC
7662) with a pluggable result cache ({{introspectionCacheEnabled}}, default
true; {{introspectionCacheTtl}}, default 60s).
Both cache implementations currently expire entries purely by insertion-time
TTL:
* {{CaffeineTokenCache}} uses {{expireAfterWrite(ttl)}}
* {{ConcurrentMapTokenCache}} stores {{expirationTime = now + ttlMillis}}
The token's own expiry ({{exp}}) is available on the cached result
({{KeycloakTokenIntrospector.IntrospectionResult#getExpiration()}}) but is not
taken into account. As a result, a cached introspection result can be reused
until the configured TTL elapses, even after the token's {{exp}} has passed.
The introspection validation paths in {{KeycloakSecurityProcessor}}
({{authenticateToken}}, {{validateRoles}}, {{validatePermissions}}) rely solely
on the cached {{active}} flag and do not re-check {{exp}}. This is inconsistent
with the local JWT verification path, which already enforces token expiry.
h3. Proposed change
* Bound each cache entry's effective lifetime by the token's remaining
validity, i.e. {{min(configuredTtl, exp - now)}}, and do not cache a result
whose {{exp}} is already in the past.
* On a cache hit, treat an entry whose {{exp}} has passed as a miss (evict and
re-introspect).
* Optionally, verify {{exp}} in the {{KeycloakSecurityProcessor}} introspection
paths so expiry is enforced consistently with the local JWT path.
h3. Affected files
*
{{components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/security/cache/CaffeineTokenCache.java}}
*
{{components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/security/cache/ConcurrentMapTokenCache.java}}
*
{{components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/security/KeycloakTokenIntrospector.java}}
*
{{components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/security/KeycloakSecurityProcessor.java}}
h3. Tests
Add unit tests covering: an entry cached before {{exp}} is not returned as
active after {{exp}}; and a result whose {{exp}} is already in the past is not
cached.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
