Refresh JWK when token contains unknown kid

[anderius]

Is your feature request related to a problem? Please describe.

We have a problem using the JWT policy (https://docs.nginx.com/nginx-ingress-controller/configuration/policy-resource/#jwt-using-jwks-from-remote-location), when the IdP rotates the key, and starts to use the new key BEFORE the caching has expired.

Describe the solution you'd like

A recommended, and very common, way to do this, is to fetch a the JWKS when the key (kid) is not found. This is recommended for example by EntraID:

https://learn.microsoft.com/en-us/entra/identity-platform/signing-key-rollover#best-practices-for-keys-metadata-caching-and-validation

The keys should be refreshed:

• Once on process startup or when cache is empty
• Periodically (recommended every 1 hour) as a background job
• Dynamically if a received token was signed with an unknown key (unknown kid or tid in the header)

Describe alternatives you've considered

Setting a very short cache time is possible, but would not be failsafe. IdPs usualle (like EntraID) have documented that they might rotate the keys very fast, when security requires it.

Additional context

Using Nginx Ingress Controller 4.0.1.

The problem is experienced with an internal IdP that rotate keys often, but the principle is valid for all IdPs.

[github-actions]

Hi @anderius thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this 🙂

Cheers!