Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OidcIdTokenDecoderFactory caches JwtDecoders and ignores ClientRegistration updates #16655

Open
iigolovko opened this issue Feb 26, 2025 · 0 comments
Labels
status: waiting-for-triage An issue we've not yet triaged type: bug A general bug

Comments

@iigolovko
Copy link

iigolovko commented Feb 26, 2025

Hello.
OidcIdTokenDecoderFactory caches JwtDecoders and ignores ClientRegistration updates.
It's required to provide uncached way to build JwtDecoder based on actual ClientRegistration.

For example we have a custom ClientRegistrationRepository that uses db to store ClientRegistrations.
It is expected that the settings can be changed dynamically. But OidcIdTokenDecoderFactory caches first created JwtDecoder by registrationId. And if we need to change value of jwsAlgorithm either jwksUri, we can't do it without the restarting of our application.

For now it can be asf crutch

OidcIdTokenDecoderFactory must provide a way to prevent caching of JwtDecoders.

For now, this can only be achieved with a dirty crutch below (via creation of new OidcIdTokenDecoderFactory everytime we need to access JwtDecoder).

@RequiredArgsConstructor
public class SsoOidcIdTokenDecoderFactory implements JwtDecoderFactory<ClientRegistration> {
    private final Function<ClientRegistration, JwsAlgorithm> jwsAlgorithmResolver;

    @Override
    public JwtDecoder createDecoder(ClientRegistration clientRegistration) {
        OidcIdTokenDecoderFactory tempFactory = new OidcIdTokenDecoderFactory();
        tempFactory.setJwsAlgorithmResolver(this.jwsAlgorithmResolver);
        return tempFactory.createDecoder(clientRegistration);
    }
}

I prepared PR that fixes it. #16647
If you have a better idea, you are welcome.

@iigolovko iigolovko added status: waiting-for-triage An issue we've not yet triaged type: bug A general bug labels Feb 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: waiting-for-triage An issue we've not yet triaged type: bug A general bug
Projects
None yet
Development

No branches or pull requests

1 participant