[
https://issues.apache.org/jira/browse/CAMEL-24902?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24902 started by Andrea Cosentino.
------------------------------------------------
> camel-keycloak: honor token expiry (exp) when caching introspection results
> ---------------------------------------------------------------------------
>
> Key: CAMEL-24902
> URL: https://issues.apache.org/jira/browse/CAMEL-24902
> Project: Camel
> Issue Type: Improvement
> Components: camel-keycloak
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> The Keycloak security policy ({{KeycloakSecurityPolicy}} /
> {{KeycloakSecurityProcessor}}) supports OAuth 2.0 token introspection (RFC
> 7662) with a pluggable result cache ({{introspectionCacheEnabled}}, default
> true; {{introspectionCacheTtl}}, default 60s).
> Both cache implementations currently expire entries purely by insertion-time
> TTL:
> * {{CaffeineTokenCache}} uses {{expireAfterWrite(ttl)}}
> * {{ConcurrentMapTokenCache}} stores {{expirationTime = now + ttlMillis}}
> The token's own expiry ({{exp}}) is available on the cached result
> ({{KeycloakTokenIntrospector.IntrospectionResult#getExpiration()}}) but is
> not taken into account. As a result, a cached introspection result can be
> reused until the configured TTL elapses, even after the token's {{exp}} has
> passed. The introspection validation paths in {{KeycloakSecurityProcessor}}
> ({{authenticateToken}}, {{validateRoles}}, {{validatePermissions}}) rely
> solely on the cached {{active}} flag and do not re-check {{exp}}. This is
> inconsistent with the local JWT verification path, which already enforces
> token expiry.
> h3. Proposed change
> * Bound each cache entry's effective lifetime by the token's remaining
> validity, i.e. {{min(configuredTtl, exp - now)}}, and do not cache a result
> whose {{exp}} is already in the past.
> * On a cache hit, treat an entry whose {{exp}} has passed as a miss (evict
> and re-introspect).
> * Optionally, verify {{exp}} in the {{KeycloakSecurityProcessor}}
> introspection paths so expiry is enforced consistently with the local JWT
> path.
> h3. Affected files
> *
> {{components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/security/cache/CaffeineTokenCache.java}}
> *
> {{components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/security/cache/ConcurrentMapTokenCache.java}}
> *
> {{components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/security/KeycloakTokenIntrospector.java}}
> *
> {{components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/security/KeycloakSecurityProcessor.java}}
> h3. Tests
> Add unit tests covering: an entry cached before {{exp}} is not returned as
> active after {{exp}}; and a result whose {{exp}} is already in the past is
> not cached.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
