Interface TrustCacheJwksChangeListener

Functional Interface:
This is a functional interface and can therefore be used as the assignment target for a lambda expression or method reference.
@FunctionalInterface public interface TrustCacheJwksChangeListener
Callback notified when JWKS data in the TrustCache is mutated.

Implementations must be non-blocking. The callback is invoked on the thread that performs the mutation (typically the rbac-extractor pipeline thread). Exceptions thrown by the listener are caught and logged by the cache and do not propagate to the cache update path.

If an implementation needs to perform blocking work (I/O, network calls, etc.), it must dispatch that work to its own executor and return immediately, so it does not stall the shared cache update thread.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    onJwksChanged(String cacheKey, String jwksEndpoint)
    Called after a JWKS entry is created or updated (its key material changed) in the trust cache.
    default void
    onJwksRemoved(String cacheKey)
    Called after a JWKS entry is removed from the trust cache (the issuer was deleted/revoked).

  • Method Details

    • onJwksChanged

      void onJwksChanged(String cacheKey, String jwksEndpoint)
      Called after a JWKS entry is created or updated (its key material changed) in the trust cache. A listener may re-fetch the live keyset in response.
      Parameters:
      cacheKey - the V2 cache key identifying the affected JWKS entry (format: issuer:jwksEndpoint, see
      invalid reference 
      io.confluent.security.auth.store.data.JwtIssuerKey#cacheKeyV2
      )
      jwksEndpoint - the upstream JWKS endpoint of the affected entry. Passed alongside the cache key because the endpoint cannot be reliably parsed back out of the V2 cache key (both issuer and jwksEndpoint are colon-bearing URLs). Lets a listener re-fetch the live keyset without having to reconstruct the endpoint.

    • onJwksRemoved

      default void onJwksRemoved(String cacheKey)
      Called after a JWKS entry is removed from the trust cache (the issuer was deleted/revoked).

      Unlike onJwksChanged(String, String), a removal must never trigger a re-fetch: the issuer is gone, so fetching from its (now-defunct) endpoint would either fail or, worse, repopulate keys for an issuer the authoritative cache no longer recognizes. Implementations should only drop any cached state for the key. No endpoint is passed for the same reason.

      Defaults to a no-op so existing single-method listeners (and lambdas) keep compiling; implementations that cache JWKS state should override it.

      Parameters:
      cacheKey - the V2 cache key identifying the removed JWKS entry