JWKS reloading in JWT auth document (#3703)

Describe new PKC (Public Key Cryptography) JSON Web Key (JWK) set
configuration settings for the JWT authentication realm.

Author: ebarlas

deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md

@@ -121,10 +121,22 @@ Client authentication is enabled by default for the JWT realms. Disabling client
   :   Indicates that {{es}} should use the `RS256` or `HS256` signature algorithms to verify the signature of the JWT from the JWT issuer.
 
   `pkc_jwkset_path`
-  :   The file name or URL to a JSON Web Key Set (JWKS) with the public key material that the JWT Realm uses for verifying token signatures. A value is considered a file name if it does not begin with `https`. The file name is resolved relative to the {{es}} configuration directory. If a URL is provided, then it must begin with `https://` (`http://` is not supported). {{es}} automatically caches the JWK set and will attempt to refresh the JWK set upon signature verification failure, as this might indicate that the JWT Provider has rotated the signing keys.
+  :   The file name or URL to a JSON Web Key Set (JWKS) with the public key material that the JWT Realm uses for verifying token signatures. A value is considered a file name if it does not begin with `https`. The file name is resolved relative to the {{es}} configuration directory. If a URL is provided, then it must begin with `https://` (`http://` is not supported). {{es}} automatically caches the JWK set and will attempt to refresh the JWK set upon signature verification failure, as this might indicate that the JWT Provider has rotated the signing keys. Background JWKS reloading can also be configured with the setting `pkc_jwkset_reload.enabled`. This ensures that rotated keys are automatically discovered and used to verify JWT signatures.
+
+  `pkc_jwkset_reload.enabled` {applies_to}`stack: ga 9.3`
+  :   Indicates whether JWKS background reloading is enabled. Defaults to `false`.
+
+  `pkc_jwkset_reload.file_interval` {applies_to}`stack: ga 9.3`
+  :   Specifies the reload interval for file-based JWKS. Defaults to `5m`.
+
+  `pkc_jwkset_reload.url_interval_min` {applies_to}`stack: ga 9.3`
+  :   Specifies the minimum reload interval for URL-based JWKS. The `Expires` and `Cache-Control` HTTP response headers inform the reload interval. This configuration setting is the lower bound of what is considered, and it is also the default interval in the absence of useful response headers. Defaults to `1h`.
+
+  `pkc_jwkset_reload.url_interval_max` {applies_to}`stack: ga 9.3`
+  :   Specifies the maximum reload interval for URL-based JWKS. This configuration setting is the upper bound of what is considered from header responses (`5d`).
 
   `claims.principal`
-  :   The name of the JWT claim that contains the user’s principal (username).
+  :   The name of the JWT claim that contains the user’s principal. Defaults to `username`.
 
   ::::
 
@@ -434,6 +446,8 @@ PKC JSON Web Token Key Sets (JWKS) can contain public RSA and EC keys. HMAC JWKS
 
 JWT realms load a PKC JWKS and an HMAC JWKS or HMAC UTF-8 JWK at startup. JWT realms can also reload PKC JWKS contents at runtime; a reload is triggered by signature validation failures.
 
+JWT realms can also be configured to reload a PKC JWKS periodically in the background.
+
 ::::{note}
 HMAC JWKS or HMAC UTF-8 JWK reloading is not supported at this time.
 ::::