Ignore JWKS keys which are not supported by the router

[garypen]

If you have a JWKS which contains a key which has an algorithm (alg) which the router doesn't recognise, then the entire JWKS is disregarded. This is unsatisfactory, since there are likely to be many other keys in the JWKS which the router could use.

We have changed the JWKS processing logic so that we remove entries with an unrecognised algorithm from the list of available keys. We print a warning with the name of the algorithm for each removed entry.

fixes: #3853

---

Checklist

Complete the checklist (and note appropriate exceptions) before the PR is marked ready-for-review.

• Changes are compatible¹
• Documentation² completed
• Performance impact assessed and acceptable
• Tests added and passing³
  • Unit Tests
  • Manual Tests

Exceptions

I manually tested with a set of keys which are known to contain alg ES512 entries. I'll add some unit tests before I merge the PR if this approach is agreed to be acceptable.

Notes

Footnotes

1. It may be appropriate to bring upcoming changes to the attention of other (impacted) groups. Please endeavour to do this before seeking PR approval. The mechanism for doing this will vary considerably, so use your judgement as to how and when to do this. ↩

2. Configuration is an important part of many changes. Where applicable please try to document configuration examples. ↩

3. Tick whichever testing boxes are applicable. If you are adding Manual Tests, please document the manual testing (extensively) in the Exceptions. ↩

[router-perf]

CI performance tests

• events_big_cap_high_rate - Stress test for events with a lot of users, deduplication enabled and high rate event with a big queue capacity
• events_without_dedup - Stress test for events with a lot of users and deduplication DISABLED
• events - Stress test for events with a lot of users and deduplication ENABLED
• large-request - Stress test with a 1 MB request payload
• step - Basic stress test that steps up the number of users over time
• xlarge-request - Stress test with 10 MB request payload
• reload - Reload test over a long period of time at a constant rate of users
• no-graphos - Basic stress test, no GraphOS.
• xxlarge-request - Stress test with 100 MB request payload
• step-jemalloc-tuning - Clone of the basic stress test for jemalloc tuning
• const - Basic stress test that runs with a constant number of users

[Geal]

This solution is a bit bruteforcing the problem. Could you try this approach: parse to a json Value, then for each element in the array, try to parse to a Jwk, accumulating the errors. That way, when the lib starts supporting ES512, it will be active right away, and when new algorithms appear, the JWKS parsing will already handle it

[garypen]

This solution is a bit bruteforcing the problem. Could you try this approach: parse to a json Value, then for each element in the array, try to parse to a Jwk, accumulating the errors. That way, when the lib starts supporting ES512, it will be active right away, and when new algorithms appear, the JWKS parsing will already handle it

Neat suggestion. That's what I've done: 7bca170