feat: add support for cacheing JWKS - #579
Open
ianroberts wants to merge 3 commits into
Open
Conversation
ianroberts
force-pushed
the
jwks-cache
branch
2 times, most recently
from
September 6, 2026 14:41
21e9f3a to
d2436a9
Compare
Add the option to configure a cache directory and max age settings in the server YAML config file, and feed these through to create a FilesystemDiscoveryCache used by the providers to cache JWKS entries. This avoids the providers having to fetch the JWKS from the provider for every single SSH login. Note this creates a bit of a race condition because - we can't parse the server config until the NewVerifyCmd has been created - NewVerifyCmd expects the verifier as a parameter - we can't create the verifier until we have parsed the server config file So I've had to change the flow in main.go to create the VerifyCmd without a verifier, then parse the server config, then use the config to create a verifier, then assign that verifier to the right field of the VerifyCmd. Signed-off-by: Ian Roberts <ian@roberts.gb.net>
Until the relevant openpubkey changes are merged, this branch will only build against my fork. Signed-off-by: Ian Roberts <ian@roberts.gb.net>
ianroberts
force-pushed
the
jwks-cache
branch
from
September 6, 2026 14:46
d2436a9 to
94572f1
Compare
Signed-off-by: Ian Roberts <ian@roberts.gb.net>
ianroberts
force-pushed
the
jwks-cache
branch
from
September 6, 2026 14:55
94572f1 to
11f8904
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR builds on the work in openpubkey/openpubkey#364 - I've temporarily
replace-d the openpubkey dep with the branch from that PR in order to make it build.Add the option to configure a cache directory and max age settings in the server YAML config file, and feed these through to create a FilesystemDiscoveryCache used by the providers to cache JWKS entries. This avoids the providers having to fetch the JWKS from the
.well-knowndiscovery URL for every single SSH login.Note this creates a bit of a race condition because
NewVerifyCmdhas been createdNewVerifyCmdexpects the verifier as a parameterSo I've had to change the flow in
main.goto create theVerifyCmdwithout a verifier, then parse the server config, then use the config to create a verifier, then assign that verifier to the right field of theVerifyCmd.Testing
I've added a unit test for the
FilesystemDiscoveryCacheitself but I'm not sure how to wire in proper end to end testing.Fixes #440