Class JwtIssuerAuthCache

java.lang.Object
io.confluent.security.authentication.oauthbearer.JwtIssuer
io.confluent.security.auth.dataplane.JwtIssuerAuthCache
All Implemented Interfaces:
Closeable, AutoCloseable, org.apache.kafka.common.Configurable
public final class JwtIssuerAuthCache extends io.confluent.security.authentication.oauthbearer.JwtIssuer implements org.apache.kafka.common.Configurable, Closeable
Fetches Signature Verification key information from AuthCache according to issuer information from the token claim. Use the parameter domainWhiteList to restrict which Issuers may provide public key information.

  • Method Details

    • name

      public String name()
      Specified by:
      name in class io.confluent.security.authentication.oauthbearer.JwtIssuer

    • audience

      public Set<String> audience()
      Specified by:
      audience in class io.confluent.security.authentication.oauthbearer.JwtIssuer

    • sessionUuid

      public String sessionUuid()

    • setJwksRefresher

      public void setJwksRefresher(JwksRefresher jwksRefresher)
      Injects the expedited-refresh coordinator used by keyResolver(Collection, SecurityContext). Passing null (the default) leaves resolution unchanged.
      Parameters:
      jwksRefresher - the refresher to wire into resolvers, or null to disable

    • close

      public void close()
      Closes the injected expedited-refresh coordinator (releasing its fetch thread pool and HTTP client) and clears the reference so resolution reverts to the inert path. Called once at broker shutdown by EnhancedOAuthBearerValidatorCallbackHandler#close().

      Idempotent: a null refresher (feature disabled, never wired, or already closed) is a no-op, as is the NoOpJwksRefresher that JwksRefresher.create(JwksFetchServiceClient, Metrics, Map) returns when the feature is off.

      Specified by:
      close in interface AutoCloseable
      Specified by:
      close in interface Closeable

    • keyResolver

      public io.confluent.security.authentication.oauthbearer.ConstrainedVerificationKeyResolver keyResolver(Collection<io.confluent.security.authentication.oauthbearer.Constraint> constraints, io.confluent.security.util.SecurityContext context)
      Returns Signature Verification Key identified by AuthCache
      Specified by:
      keyResolver in class io.confluent.security.authentication.oauthbearer.JwtIssuer
      Parameters:
      constraints - Collection of Constraint to be enforced.
      Returns:
      ConstrainedVerificationKeyResolver

    • builder

      public static JwtIssuerAuthCache.Builder builder()

    • configure

      public void configure(Map<String,?> configs)
      Specified by:
      configure in interface org.apache.kafka.common.Configurable