Skip to content

Allow wrapper-controlled init to fix jwk_uri backward compatibility (Issue #3054) #3198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sh1myama wants to merge 2 commits into
base: master
Choose a base branch
from
+23 −11
Open

Allow wrapper-controlled init to fix jwk_uri backward compatibility (Issue #3054) #3198

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
37e9e7c
init serverUrl & proxyUrl in init() method
hiragi-gkuth Feb 4, 2026
0f2569c
ZPE: Add support for optional JWK URI requirement in AuthZpeClient
sh1myama Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 18 additions & 7 deletions clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/AuthZpeClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ public class AuthZpeClient {

private static int allowedOffset = 300;
private static JwtsSigningKeyResolver accessSignKeyResolver = null;
private static boolean tokenSignKeyResolverInitialized = false;

private static ZpeClient zpeClt = null;
private static PublicKeyStore publicKeyStore = null;
Expand Down Expand Up @@ -155,7 +156,7 @@ public String toString() {
}

static {

// load public keys

setPublicKeyStoreFactoryClass(System.getProperty(ZpeConsts.ZPE_PROP_PUBLIC_KEY_CLASS, ZPE_PKEY_CLASS));
Expand All @@ -178,17 +179,22 @@ public String toString() {

// initialize the access token signing key resolver

initializeAccessTokenSignKeyResolver();
initializeAccessTokenSignKeyResolver(false);

// save the last zts api call time, and the allowed interval between api calls

setMillisBetweenZtsCalls(Long.parseLong(System.getProperty(ZPE_PROP_MILLIS_BETWEEN_ZTS_CALLS, Long.toString(30 * 1000 * 60))));
if (tokenSignKeyResolverInitialized) {
setMillisBetweenZtsCalls(Long.parseLong(System.getProperty(ZPE_PROP_MILLIS_BETWEEN_ZTS_CALLS, Long.toString(30 * 1000 * 60))));
Copy link
Copy Markdown
Collaborator

@havetisyan havetisyan Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's move this setMillisBetweenZtsCalls as the last line in the initializeAccessTokenSignKeyResolver method. this way we don't have to repeat the call twice once here and then once again in init method

}
}

public static void init() {
if (LOG.isDebugEnabled()) {
LOG.debug("Init: load the ZPE");
}
if (!tokenSignKeyResolverInitialized) {
initializeAccessTokenSignKeyResolver(true);
setMillisBetweenZtsCalls(Long.parseLong(System.getProperty(ZPE_PROP_MILLIS_BETWEEN_ZTS_CALLS, Long.toString(30 * 1000 * 60))));
}
}

public static void close() {
Expand All @@ -198,11 +204,15 @@ public static void close() {
zpeClt.close();
}

public static void initializeAccessTokenSignKeyResolver() {
public static void initializeAccessTokenSignKeyResolver(boolean throwOnMissingUrl) {
String serverUrl = System.getProperty(ZpeConsts.ZPE_PROP_JWK_URI);
if (serverUrl == null || serverUrl.isEmpty()) {
throw new IllegalArgumentException("Missing required property: " + ZpeConsts.ZPE_PROP_JWK_URI);
if (throwOnMissingUrl) {
throw new IllegalArgumentException("Missing required property: " + ZpeConsts.ZPE_PROP_JWK_URI);
}
return;
}
String proxyUrl = System.getProperty(ZpeConsts.ZPE_PROP_JWK_PROXY_URI);
Comment thread
havetisyan marked this conversation as resolved.

final String keyPath = System.getProperty(ZpeConsts.ZPE_PROP_JWK_PRIVATE_KEY_PATH);
final String certPath = System.getProperty(ZpeConsts.ZPE_PROP_JWK_X509_CERT_PATH);
Expand All @@ -217,7 +227,8 @@ public static void initializeAccessTokenSignKeyResolver() {
LOG.error("Unable to initialize key refresher: {}", ex.getMessage());
}
}
setAccessTokenSignKeyResolver(serverUrl, sslContext);
setAccessTokenSignKeyResolver(serverUrl, sslContext, proxyUrl);
tokenSignKeyResolverInitialized = true;
}

/**
Expand Down
1 change: 1 addition & 0 deletions clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeConsts.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ public final class ZpeConsts {
public static final String ZPE_PROP_ATHENZ_CONF = "athenz.athenz_conf";
public static final String ZPE_PROP_JWK_ATHENZ_CONF = "athenz.jwk_athenz_conf";
public static final String ZPE_PROP_JWK_URI = "athenz.zpe.jwk_uri";
public static final String ZPE_PROP_JWK_PROXY_URI = "athenz.zpe.jwk_proxy_uri";
public static final String ZPE_PROP_JWK_PRIVATE_KEY_PATH = "athenz.zpe.jwk_private_key_path";
public static final String ZPE_PROP_JWK_X509_CERT_PATH = "athenz.zpe.jwk_x509_cert_path";

Expand Down
8 changes: 4 additions & 4 deletions clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestAuthZpe.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1537,15 +1537,15 @@ public void testMaxCacheTokenSize() throws IOException {
public void testInitializeAccessTokenSignKeyResolver() throws IOException {
final String originalJwkValue = System.clearProperty(ZpeConsts.ZPE_PROP_JWK_URI);
try {
AuthZpeClient.initializeAccessTokenSignKeyResolver();
AuthZpeClient.initializeAccessTokenSignKeyResolver(true);
fail();
} catch (Exception ex) {
assertTrue(ex.getMessage().contains("Missing required property"));
}

System.setProperty(ZpeConsts.ZPE_PROP_JWK_URI, "");
try {
AuthZpeClient.initializeAccessTokenSignKeyResolver();
AuthZpeClient.initializeAccessTokenSignKeyResolver(true);
fail();
} catch (Exception ex) {
assertTrue(ex.getMessage().contains("Missing required property"));
Expand All @@ -1557,15 +1557,15 @@ public void testInitializeAccessTokenSignKeyResolver() throws IOException {
System.setProperty(ZpeConsts.ZPE_PROP_JWK_URI, "file://" + jwkUri);
System.setProperty(ZpeConsts.ZPE_PROP_JWK_PRIVATE_KEY_PATH, "src/test/resources/jwk/athenz_private.pem");
System.setProperty(ZpeConsts.ZPE_PROP_JWK_X509_CERT_PATH, "src/test/resources/jwk/athenz_x509.pem");
AuthZpeClient.initializeAccessTokenSignKeyResolver();
AuthZpeClient.initializeAccessTokenSignKeyResolver(true);

// try with valid paths

String keyPath = new File("src/test/resources/unit_test_ec_private.key").getCanonicalPath();
String certPath = new File("src/test/resources/ec_public_x509.cert").getCanonicalPath();
System.setProperty(ZpeConsts.ZPE_PROP_JWK_PRIVATE_KEY_PATH, keyPath);
System.setProperty(ZpeConsts.ZPE_PROP_JWK_X509_CERT_PATH, certPath);
AuthZpeClient.initializeAccessTokenSignKeyResolver();
AuthZpeClient.initializeAccessTokenSignKeyResolver(true);

// reset the original state

Expand Down
Loading