Andrea Cosentino created CAMEL-26532:
----------------------------------------
Summary: camel-keycloak: KeycloakPublicKeyResolver should rate
limit remote JWKS refresh on unknown kid
Key: CAMEL-26532
URL: https://issues.apache.org/jira/browse/CAMEL-26532
Project: Camel
Issue Type: Improvement
Components: camel-keycloak
Reporter: Andrea Cosentino
In KeycloakPublicKeyResolver, when getPublicKey(String kid) is called with a
key ID (kid) that is not present in the local keyCache, it immediately triggers
a synchronous refreshKeys() call to fetch keys from the Keycloak server JWKS
endpoint.
When incoming tokens contain unknown or rotated key IDs in rapid succession,
this causes repetitive synchronous remote HTTP calls to the Keycloak certs
endpoint and contention on the resolver lock. In addition, when the cache is
initially empty, an incoming request with a kid triggers two consecutive
refresh calls.
KeycloakPublicKeyResolver should be improved to:
1. Rate limit or introduce a minimum cooldown interval between remote JWKS
refreshes for unknown key IDs.
2. Avoid double refresh on initial token resolution when the cache is empty.
3. Keep existing cached public keys intact until new keys are successfully
fetched and parsed.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
