Class JwksFetchServiceClient

java.lang.Object

io.confluent.kafka.server.plugins.auth.oauth.JwksFetchServiceClient

All Implemented Interfaces:

Closeable, AutoCloseable

public class JwksFetchServiceClient
extends Object
implements Closeable

HTTP client for the regional JWKS Fetch Service.

Used during expedited key refresh: when a broker encounters an unknown JWT kid, it calls the regional JWKS Fetch Service to retrieve the latest key set directly, bypassing the normal rbac-extractor propagation pipeline.

fetchJwks(String) is non-blocking by construction: it runs the blocking HTTP exchange on an owned, bounded thread pool and returns a CompletableFuture. The calling (e.g. authentication) thread is never blocked on the network, regardless of caller discipline.

SVID rotation is handled automatically by the SPIRE-backed SSLContext's underlying KeyManager/TrustManager.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	JwksFetchServiceClient.FetchFailureReason	Why a fetch did not produce a key set.
static final record	JwksFetchServiceClient.FetchOutcome	Outcome of a fetchJwks(String) call: exactly one of keySet (success) or failureReason (failure) is non-null.

Method Summary

Modifier and Type	Method	Description
void	close()
static Optional<JwksFetchServiceClient>	create(Map<String,?> configs, SSLContext sslContext)	Creates a client from broker config, or Optional.empty() if no fetch-service URL is configured.
CompletableFuture<JwksFetchServiceClient.FetchOutcome>	fetchJwks(String jwksUri)	Fetches a JWKS from the regional JWKS Fetch Service.

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

create

public static Optional<JwksFetchServiceClient> create(Map<String,?> configs,
 SSLContext sslContext)

Creates a client from broker config, or Optional.empty() if no fetch-service URL is configured. The URL, request timeout, and fetch-thread pool size are read from ConfluentConfigs here so callers pass a config map rather than a positional parameter list; their defaults live in ConfluentConfigs. The sslContext is supplied separately because it comes from SPIRE wiring, not the config.

An empty/blank URL means expedited refresh has nowhere to fetch from, so no client (and no thread pool) is built; the caller treats the empty result as "fetch service not configured".

Parameters:

configs - the broker config map (already validated against the broker ConfigDef)

sslContext - the SPIRE-backed mTLS context for the fetch-service connection

fetchJwks

public CompletableFuture<JwksFetchServiceClient.FetchOutcome> fetchJwks(String jwksUri)

Fetches a JWKS from the regional JWKS Fetch Service. The blocking HTTP exchange runs on the client's owned thread pool, so the calling thread is never blocked.

Parameters:

jwksUri - the upstream JWKS URI to fetch (will be URL-encoded as a query parameter)

Returns:

a future that always completes (never completes exceptionally) with a JwksFetchServiceClient.FetchOutcome carrying the parsed JsonWebKeySet on success, or a JwksFetchServiceClient.FetchFailureReason on any error; never null

close

public void close()

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable