Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Identity provider key caching behavior causing lookup conflict #2915

Closed
wants to merge 1 commit into from
Closed

Identity provider key caching behavior causing lookup conflict #2915

wants to merge 1 commit into from

Commits on Jun 4, 2024

  1. Identity provider key caching behavior causing lookup conflict 

    Problem:
UAA caches the key from Identity provider. The default cache eviction time is 10 minutes. When the Identity provider changes the key, the UAA may end up with stale key in the cache.
All the token validations will fail during stale key period.

Resolution:
In case of signature validation failure, invalidate the cache and retrieve the latest/current key from Identity Provider and use it for validation. This behaviour is applicable for all signature validation failure.

Another potential solution considered:
Provide an endpoint or update existing endpoint that enables Identity provider to trigger cache invalidation upon key change.

Testing done:
Unit test and IT added
Manual testing done by deploying a UAA and an Idenity provider.

Signed-off-by: Peter Chen <peter-h.chen@broadcom.com>
    @coolgang123
    coolgang123 committed Jun 4, 2024
    Configuration menu
    Copy the full SHA
    bc0eec3 View commit details
    Browse the repository at this point in the history