Refresh JWK when token contains unknown kid

[anderius]

Is your feature request related to a problem? Please describe.

We have a problem using the JWT policy (https://docs.nginx.com/nginx-ingress-controller/configuration/policy-resource/#jwt-using-jwks-from-remote-location), when the IdP rotates the key, and starts to use the new key BEFORE the caching has expired.

Describe the solution you'd like

A recommended, and very common, way to do this, is to fetch a the JWKS when the key (kid) is not found. This is recommended for example by EntraID:

https://learn.microsoft.com/en-us/entra/identity-platform/signing-key-rollover#best-practices-for-keys-metadata-caching-and-validation

The keys should be refreshed:

• Once on process startup or when cache is empty
• Periodically (recommended every 1 hour) as a background job
• Dynamically if a received token was signed with an unknown key (unknown kid or tid in the header)

Describe alternatives you've considered

Setting a very short cache time is possible, but would not be failsafe. IdPs usualle (like EntraID) have documented that they might rotate the keys very fast, when security requires it.

Additional context

Using Nginx Ingress Controller 4.0.1.

The problem is experienced with an internal IdP that rotate keys often, but the principle is valid for all IdPs.

Tasks:

• POC -Refresh JWK when token contains unknown kid

[github-actions]

Hi @anderius thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this 🙂

Cheers!

[fabriziofiorucci]

The logical flow is:

1. auth_jwt wants to validate a token and uses auth_jwt_key_request to retrieve the necessary keys.
2. The module always performs an HTTP request to fetch the jwks.
3. When proxy_cache is used, this request is satisfied almost instantly from cache and there are no actual request sent to the external IDP
4. auth_jwt receives the jwks, parses it, builds the required crypto structures using the underlying crypto lib, verifies the signature, clears its context, and releases the original request
5. auth_jwt_key_cache goes a step further: it retains the crypto context for future reuse. However, if a JWT comes in with a kid that does not exist in the cached context, it detects that something is likely outdated and go back to step 1

This means that getting rid of proxy_cache in the /_jwks* location should make it work. This could be probably achieved by removing

         {{- if .KeyCache }}
         proxy_cache jwks_uri_{{ $s.VSName }};
         proxy_cache_valid 200 12h;
         {{- end }}

from nginx-plus.virtualserver.tmpl