OIDC local_validation does not appear to refresh JWKS when token kid changes

[ict-devteam-iit]

Summary

We observed an authentication issue with irods_client_http_api when using OpenID Connect with local JWT validation.

After an OIDC provider key rotation, valid access tokens started being rejected because the JWT header contained a kid that did not appear to be recognized by irods_client_http_api.

Restarting the irods_client_http_api container resolved the issue, which suggests that the JWKS / signing key state used by local_validation may not have been refreshed automatically.

Environment

• irods_client_http_api image/version: 0.6.0
• Deployment: Docker Compose
• OIDC provider: Microsoft Entra ID
• OIDC mode: protected_resource
• Access token validation method: local_validation

Relevant configuration:

"openid_connect": {
    "provider_url": "https://sts.windows.net/<tenant-id>/",
    "client_id": "api://<client-id>",
    "mode": "protected_resource",
    "access_token_validation_method": "local_validation",
    "tls_certificates_directory": "/etc/ssl/certs"
}

[MartinFlores751]

Restarting the irods_client_http_api container resolved the issue, which suggests that the JWKS / signing key state used by local_validation may not have been refreshed automatically.

That is correct. Currently, the JWKS is not being updated automatically. The JWKS used are only retrieved once on the first validation attempt and then cached. The main concern was to avoid continuously reaching out to the provider for the JWKS set when a key is expired, new, etc.

I think a simple solution to this issue is to allow for updates after a configurable cooldown (e.g. 1 hour). The JWKS would be allowed to be updated on either the desired JWK being missing or a JWK expiring (this assumes that there is a parameter that notes when the JWK expires). This also prevents someone from attempting to send multiple JWKS update requests to the OIDC provider.