Skip to content

Allow wrapper-controlled init to fix jwk_uri backward compatibility (Issue #3054) #3198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sh1myama wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Allow wrapper-controlled init to fix jwk_uri backward compatibility (Issue #3054) #3198

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
37e9e7c
init serverUrl & proxyUrl in init() method
hiragi-gkuth Feb 4, 2026
0f2569c
ZPE: Add support for optional JWK URI requirement in AuthZpeClient
sh1myama Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/AuthZpeClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,7 @@ public String toString() {
}

static {

// load public keys

setPublicKeyStoreFactoryClass(System.getProperty(ZpeConsts.ZPE_PROP_PUBLIC_KEY_CLASS, ZPE_PKEY_CLASS));
Expand All @@ -175,7 +175,12 @@ public String toString() {
// load the x509 issuers

setX509CAIssuers(System.getProperty(ZpeConsts.ZPE_PROP_X509_CA_ISSUERS));
}

public static void init() {
if (LOG.isDebugEnabled()) {
LOG.debug("Init: load the ZPE");
}
// initialize the access token signing key resolver

initializeAccessTokenSignKeyResolver();
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The new init() method is not thread-safe or idempotent. If called concurrently (e.g., during application startup or in parallel tests), it can lead to race conditions during the initialization of static resources. It's a best practice to ensure that initialization methods like this execute only once.

You can make this method thread-safe and idempotent by using a static flag with double-checked locking. This will ensure the initialization logic is performed safely and exactly one time.

Example:

// Add this field to the class
private static volatile boolean zpeInitialized = false;

// Modify the init() method
public static void init() {
    // Quick check without lock
    if (zpeInitialized) {
        return;
    }
    synchronized (AuthZpeClient.class) {
        // Check again inside the synchronized block
        if (zpeInitialized) {
            return;
        }

        if (LOG.isDebugEnabled()) {
            LOG.debug("Init: load the ZPE");
        }

        // ... current init logic ...
        initializeAccessTokenSignKeyResolver();
        // ... other set calls that were moved ...

        zpeInitialized = true;
    }
}

Expand All @@ -185,12 +190,6 @@ public String toString() {
setMillisBetweenZtsCalls(Long.parseLong(System.getProperty(ZPE_PROP_MILLIS_BETWEEN_ZTS_CALLS, Long.toString(30 * 1000 * 60))));
}

public static void init() {
if (LOG.isDebugEnabled()) {
LOG.debug("Init: load the ZPE");
}
}

public static void close() {
if (LOG.isDebugEnabled()) {
LOG.debug("close: finishing the ZPE");
Expand All @@ -203,6 +202,7 @@ public static void initializeAccessTokenSignKeyResolver() {
if (serverUrl == null || serverUrl.isEmpty()) {
throw new IllegalArgumentException("Missing required property: " + ZpeConsts.ZPE_PROP_JWK_URI);
}
String proxyUrl = System.getProperty(ZpeConsts.ZPE_PROP_JWK_PROXY_URI);
Comment thread
havetisyan marked this conversation as resolved.

final String keyPath = System.getProperty(ZpeConsts.ZPE_PROP_JWK_PRIVATE_KEY_PATH);
final String certPath = System.getProperty(ZpeConsts.ZPE_PROP_JWK_X509_CERT_PATH);
Expand All @@ -217,7 +217,7 @@ public static void initializeAccessTokenSignKeyResolver() {
LOG.error("Unable to initialize key refresher: {}", ex.getMessage());
}
}
setAccessTokenSignKeyResolver(serverUrl, sslContext);
setAccessTokenSignKeyResolver(serverUrl, sslContext, proxyUrl);
}

/**
Expand Down
1 change: 1 addition & 0 deletions clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeConsts.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ public final class ZpeConsts {
public static final String ZPE_PROP_ATHENZ_CONF = "athenz.athenz_conf";
public static final String ZPE_PROP_JWK_ATHENZ_CONF = "athenz.jwk_athenz_conf";
public static final String ZPE_PROP_JWK_URI = "athenz.zpe.jwk_uri";
public static final String ZPE_PROP_JWK_PROXY_URI = "athenz.zpe.jwk_proxy_uri";
public static final String ZPE_PROP_JWK_PRIVATE_KEY_PATH = "athenz.zpe.jwk_private_key_path";
public static final String ZPE_PROP_JWK_X509_CERT_PATH = "athenz.zpe.jwk_x509_cert_path";

Expand Down