Fix Microsoft JWT validation during Azure key rotation (refresh JWKS + retry on unknown kid)

[stephenstack]

Summary
Fixes intermittent Microsoft SSO failures introduced in socialiteproviders/microsoft 4.7.0 where id_token validation can fail during Azure AD / Entra ID signing key rotation if the token’s kid is not present in the currently published JWKS.

Fixes #1402.

Background / Bug
Starting in 4.7.0 the provider validates the id_token signature using firebase/php-jwt + JWKS fetched from the OpenID discovery document. During Microsoft key rollovers there can be a brief window where:

• Azure signs an ID token with a new key (kid = X)
• kid = X is not yet available (or no longer available) in the JWKS endpoint
• firebase/php-jwt throws an exception (e.g. "kid" invalid, unable to lookup correct key)
• Socialite login fails for legitimate users

What changed

• Cache OpenID configuration (short-lived) and JWKS (short-lived) to avoid repeated discovery/key fetches.
• When JWT signature validation fails specifically due to an unknown kid, force-refresh the JWKS (with Cache-Control: no-cache) and retry validation once before failing.

Behavior / Compatibility

• No behavior change for any other validation failures (issuer/audience/expiration/etc).
• No new required dependencies: uses Laravel Cache when available; otherwise falls back to fetching as before.
• Retry happens only once to avoid loops.

Verification
vendor/bin/parallel-lint src/Microsoft

[Copilot]

Pull request overview

This PR improves Microsoft id_token JWT validation reliability during Azure AD / Entra ID signing key rotation by caching discovery/JWKS data and retrying signature verification once when encountering an unknown kid.

Changes:

• Add short-lived caching for OpenID configuration and JWKS (with in-memory + optional Laravel Cache support).
• On JWT decode failure due to unknown kid, force-refresh JWKS (no-cache headers) and retry validation once.
• Document the ID token validation + key rollover behavior in the Microsoft provider README.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/Microsoft/Provider.php	Adds OpenID/JWKS caching and a one-time JWKS refresh + retry when kid lookup fails during JWT validation.
src/Microsoft/README.md	Documents how ID token validation behaves during Microsoft key rollover.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.