Commits on Dec 23, 2023

1. CRDB-28040 : JWKS fetch from jwks_uri …

   This commit adds capability to fetch remote JWKS from issuer's jwks_uri endpoint. This will satisfy the requirement to have an ability to automatically fetch the new JWK when the existing JWK is rotated - without human intervention or custom scripts.
   
   Changes include
   
   1. The existing order of token signature verification first and rest of claims next is modified to get issuer first and then the token signature verification. This change is requied to determine the issuer for which the jwks has to be fetched remotely.
   
   2. Introduction of a new cluster setting called `server.jwt_authentication.jwks_auto_fetch.enabled`
   
   3. Depending on the value of `server.jwt_authentication.jwks_auto_fetch.enabled` use JWKS configured through cluster setting or remotely fetch JWKS from jwks_uri of the issuer
   
   4. Modification to exiting test cases to match the new order of verification steps.
   
   The change is backward compatible and no changes required in existing deployments and JWT Auth usage.

   

   BabuSrithar committed Dec 23, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 61776d5
   • Browse repository at this point

   Copy the full SHA

   61776d5 View commit details

   Browse the repository at this point in the history