Package net.shibboleth.oidc.jwk

Class RemoteJwkSetCache

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.oidc.jwk.RemoteJwkSetCache
All Implemented Interfaces:
Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
public class RemoteJwkSetCache extends AbstractIdentifiableInitializableComponent
Stores fetched remote key set values for a desired period of time.

  • Field Details

    • CONTEXT_NAME

      public static final String CONTEXT_NAME
      The context name in the StorageService.
      See Also:

    • log

      private final org.slf4j.Logger log
      Logger.

    • storage

      private StorageService storage
      Backing storage for the remote JWK set contents.

    • httpClient

      @NonnullAfterInit private org.apache.hc.client5.http.classic.HttpClient httpClient
      The HttpClient to use.

    • httpClientSecurityParameters

      @Nullable private HttpClientSecurityParameters httpClientSecurityParameters
      HTTP client security parameters.

  • Constructor Details

    • RemoteJwkSetCache

      public RemoteJwkSetCache()

  • Method Details

    • getStorage

      @NonnullAfterInit public StorageService getStorage()
      Get the backing store for the remote JWK set contents.
      Returns:
      the backing store.

    • setStorage

      public void setStorage(@Nonnull StorageService storageService)
      Set the backing store for the remote JWK set contents.
      Parameters:
      storageService - backing store to use

    • setHttpClient

      public void setHttpClient(@Nonnull org.apache.hc.client5.http.classic.HttpClient client)
      Set the HttpClient to use.
      Parameters:
      client - client to use

    • setHttpClientSecurityParameters

      public void setHttpClientSecurityParameters(@Nullable HttpClientSecurityParameters params)
      Set the optional client security parameters.
      Parameters:
      params - the new client security parameters

    • doInitialize

      public void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractIdentifiedInitializableComponent
      Throws:
      ComponentInitializationException

    • fetch

      @Nullable public JWKSet fetch(@Nonnull URI uri, @Nonnull String keyId, @Nonnull Instant expires)
      Returns remote JWK set if found from the cache, otherwise fetches and stores it. If the JWK set is from the cache check it contains the keyId and if not, refresh the JWK set in the cache. Uses the default CONTEXT_NAME. Delegates to fetch(String, URI, String, Instant) for the actual implementation.
      Parameters:
      uri - value to check
      keyId - the identifier of the key to check exists in a cached version of the keyset document
      expires - time for disposal of value from cache
      Returns:
      JWK set, null if not found from the cache and cannot be fetched.
      Since:
      2.2.0

    • fetch

      @Nullable public JWKSet fetch(@Nonnull URI uri, @Nonnull Instant expires)
      Returns remote JWK set if found from the cache, otherwise fetches and stores it.
      Parameters:
      uri - value to check
      expires - time for disposal of value from cache
      Returns:
      JWK set, null if not found from the cache and cannot be fetched.

    • fetch

      @Nullable public JWKSet fetch(@Nonnull @NotEmpty String context, @Nonnull URI uri, @Nonnull Instant expires)
      Returns remote JWK set if found from the cache, otherwise fetches and stores it.
      Parameters:
      context - a context label to subdivide the cache
      uri - value to check
      expires - time (in milliseconds since beginning of epoch) for disposal of value from cache
      Returns:
      JWK set, null if not found from the cache and cannot be fetched.

    • fetchAndStore

      @Nullable private JWKSet fetchAndStore(@Nonnull @NotEmpty String context, @Nonnull String cacheKey, @Nonnull URI uri, @Nonnull Instant expires)
      Fetches the remote JWK set from the given URI and stores it in the storage service.
      Parameters:
      context - a context label to subdivide the cache
      cacheKey - the key to store the JWK set under in the storage service
      uri - value to fetch the JWK set from
      expires - time (in milliseconds since beginning of epoch) for disposal of value from cache
      Returns:
      the JWK set document if fetched successfully, null otherwise.
      Since:
      2.2.0

    • fetch

      @Nullable public JWKSet fetch(@Nonnull @NotEmpty String context, @Nonnull URI uri, @Nonnull String keyId, @Nonnull Instant expires)
      Returns remote JWK set if found from the cache, otherwise fetches and stores it. If the JWK set is retrieved from the cache, checks it contains the JWK keyId input, if not it re-fetches the JWK set even if the set has not expired. This allows keys to be returned when the JWK Set has been updated but has not yet expired e.g. during key rotation.
      Parameters:
      context - a context label to subdivide the cache
      uri - value to check
      keyId - the identifier of the key to check exists in a cached version of the keyset document
      expires - time (in milliseconds since beginning of epoch) for disposal of value from cache
      Returns:
      JWK set, null if not found from the cache and cannot be fetched.
      Since:
      2.2.0