Reloading of JWKS CA certificates

[scholzj]

Description

It seems that the OAuth library does not reload the CA certificates used for the JWKS HTTPS connections at runtime but only at startup. Would it make sense to for example reload them together with the JWKS keys?

[mstruk]

That's correct, the SSLSocketFactory used for communication with the authorization server is a Kafka CallbackHandler scoped object. The assumption was that the truststore file with the CAs doesn't change for the life of the Kafka broker instance. If that is not the case, is there some callback at Kafka level we should be using in order to detects the change? We could also simply add a file watch using Java native libraries, that detects a file change at runtime. Alternatively, we could tie it to the service job that refreshes the JWKS keys, but that would only work for JWKS validation mechanism, not if validation is done in real time using the introspection endpoint. The cleanest way would be one that works for all the cases.

[scholzj]

TBH, I was thinking mainly about the JWKS endpoint as that is what I was dealing with strimzi/strimzi-kafka-operator#13110. There we use the JWKS with the Kubernetes Service Account ca.crt. So that is where the idea about always loading the certificate when reloading the JWKS makes sense.

You are right that this might be problem elsewhere as well. But I'm not sure if in the other cases the certificates will update on the fly or not. I'm not even sure how much it is relevant to my use-case either to be honest. I think that normally, the CA rotation in Kubernetes use the CAs in parallel for some time. But the Kafka Pods run sometimes for months without disruption. So it might be an issue. But having a more generic solution might be of course better.