Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Decrease minimum jwk rotation time #30011

Open
wants to merge 4 commits into
base: integration
Choose a base branch
from
+17 −7
Open

Decrease minimum jwk rotation time #30011

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b63a74e
Reduce min jwk rotation time to 0m
Oct 30, 2024
1fdc047
Merge branch 'release' of github.com:OpenLiberty/open-liberty into de…
Oct 30, 2024
bc55277
Merge branch 'integration' of github.com:jcharnetsky/open-liberty int…
Oct 30, 2024
e23ee22
Address PR comments
Oct 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions ...bm.ws.security.common.jsonwebkey/src/com/ibm/ws/security/common/jwk/impl/JWKProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,15 +71,18 @@ public JWKProvider(int keySize, String alg, long rotationTimeMs) {
this.size = keySize;
JWKS_TO_GENERATE = 2;
this.alg = alg;
if (rotationTimeMs <= 0) {
if (rotationTimeMs < 0) {
if (tc.isDebugEnabled()) {
Tr.debug(tc, "Specified rotation time " + rotationTimeMs + " <= 0. Setting rotation time to the default (" + DEFAULT_ROTATION_TIME + " ms) instead");
Tr.debug(tc, "Specified rotation time " + rotationTimeMs + " < 0. Setting rotation time to the default (" + DEFAULT_ROTATION_TIME + " ms) instead");
}
rotationTimeMs = DEFAULT_ROTATION_TIME;
}
this.rotationTimeInMilliseconds = rotationTimeMs;

scheduleRotationTask();
// A rotation time of 0ms means do not rotate
if (rotationTimeInMilliseconds != 0) {
scheduleRotationTask();
}
}

public JWKProvider(int keySize, String alg, long rotationTimeMs, PublicKey publicKey, PrivateKey privateKey) {
Expand All @@ -91,9 +94,9 @@ public JWKProvider(int keySize, String alg, long rotationTimeMs, PublicKey publi
}
this.size = keySize;
this.alg = alg;
if (rotationTimeMs <= 0) {
if (rotationTimeMs < 0) {
if (tc.isDebugEnabled()) {
Tr.debug(tc, "Specified rotation time " + rotationTimeMs + " <= 0. Setting rotation time to the default (" + DEFAULT_ROTATION_TIME + " ms) instead");
Tr.debug(tc, "Specified rotation time " + rotationTimeMs + " < 0. Setting rotation time to the default (" + DEFAULT_ROTATION_TIME + " ms) instead");
}
rotationTimeMs = DEFAULT_ROTATION_TIME;
}
Expand Down
7 changes: 7 additions & 0 deletions ....security.common.jsonwebkey/test/com/ibm/ws/security/common/jwk/impl/JWKProviderTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,13 @@ public void testConstructor() {
assertEquals("Rotation time was not the expected value.", defaultRotationTime, provider.rotationTimeInMilliseconds);
assertEquals("Number of generated JWKs was not expected value.", 0, provider.jwks.size());

// Allow 0m rotation time, resulting in keys never rotating
provider = new JWKProvider(defaultKeySize, RS256, 0);
assertEquals("Key size was not the expected length.", defaultKeySize, provider.size);
assertEquals("Did not get expected algorithm.", RS256, provider.alg);
assertEquals("Rotation time was not the expected value.", 0, provider.rotationTimeInMilliseconds);
assertEquals("Number of generated JWKs was not expected value.", 0, provider.jwks.size());
assertEquals("Timer was not expected value.", null, provider.timer);
} catch (Throwable t) {
outputMgr.failWithThrowable(testName.getMethodName(), t);
}
Expand Down
2 changes: 1 addition & 1 deletion dev/com.ibm.ws.security.jwt/resources/OSGI-INF/metatype/metatype.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
<AD id="keyStoreRef" name="%keyStoreRef" description="%keyStoreRef.desc" required="false" type="String" ibmui:uiReference="com.ibm.ws.ssl.keystore" />
<AD id="keyAlias" name="%keyAliasName" description="%keyAliasName.desc" required="false" type="String" />
<AD id="trustStoreRef" name="%trustStoreRef" description="%trustStoreRef.builder.desc" required="false" type="String" ibmui:uiReference="com.ibm.ws.ssl.keystore" />
<AD id="jwkRotationTime" name="internal" description="internal use only" required="false" type="String" ibm:type="duration(m)" default="720m" min="60m"/>
<AD id="jwkRotationTime" name="internal" description="internal use only" required="false" type="String" ibm:type="duration(m)" default="720m" min="0m"/>
<AD id="jwkSigningKeySize" name="internal" description="internal use only" required="false" type="Long" default="2048">
<Option label="%jwkSigningKeySize.1024" value="1024"/>
<Option label="%jwkSigningKeySize.2048" value="2048"/>
Expand Down
2 changes: 1 addition & 1 deletion dev/com.ibm.ws.security.openidconnect.server/resources/OSGI-INF/l10n/metatype.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,7 +183,7 @@ idTokenCacheEnabled=Cache ID tokens
idTokenCacheEnabled.desc=Enable caching to save ID tokens in the database and in-memory cache.

jwkRotationTime=JWK rotation time
jwkRotationTime.desc=Amount of time after which a new JWK is generated (minutes). For example, specify 90 minutes as 90 or 90m. Minimum value is 60 minutes.
jwkRotationTime.desc=The amount of time after which a new JWK is generated in minutes. For example, specify 90 minutes as 90 or 90m. The minimum value of time is 0 minutes, where 0 minutes disables key rotation.

jwkSigningKeySize=JWK signing key size
jwkSigningKeySize.desc=Size measured in bits of the signing key.
Expand Down