feat: add support for cacheing JWKS - #579
Open
ianroberts wants to merge 5 commits into
Open
ianroberts wants to merge 5 commits into
ianroberts wants to merge 5 commits into
Conversation
ianroberts
force-pushed
the
jwks-cache
branch
4 times, most recently
from
September 6, 2026 14:55
94572f1 to
11f8904
Compare
Add the option to configure a cache directory and max age settings in the server YAML config file, and feed these through to create a FilesystemDiscoveryCache used by the providers to cache JWKS entries. This avoids the providers having to fetch the JWKS from the provider for every single SSH login. Note this creates a bit of a race condition because - we can't parse the server config until the NewVerifyCmd has been created - NewVerifyCmd expects the verifier as a parameter - we can't create the verifier until we have parsed the server config file So I've had to change the flow in main.go to create the VerifyCmd without a verifier, then parse the server config, then use the config to create a verifier, then assign that verifier to the right field of the VerifyCmd. Signed-off-by: Ian Roberts <ian@roberts.gb.net>
Signed-off-by: Ian Roberts <ian@roberts.gb.net>
Signed-off-by: Ian Roberts <ian@roberts.gb.net>
ianroberts
force-pushed
the
jwks-cache
branch
from
September 14, 2026 12:58
11f8904 to
bc87c42
Compare
Signed-off-by: Ian Roberts <ian@roberts.gb.net>
I've made a deliberate design decision that `oppkssh verify` will never itself delete anything from the cache, since multiple instances may potentially be running at the same time. Instead I've introduced a specific command `opkssh cache clean` that will delete anything in the cache that is older than the `fallback_max_age` - this should be set up to run regularly as a cron job under the `opkssh` UID. Signed-off-by: Ian Roberts <ian@roberts.gb.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR builds on the work in openpubkey/openpubkey#364 - the openpubkey dep has been updated to the commit where that PR was merged, it will need to be updated again once the openpubkey changes make it into a tagged version
Add the option to configure a cache directory and max age settings in the server YAML config file, and feed these through to create a FilesystemDiscoveryCache used by the providers to cache JWKS entries. This avoids the providers having to fetch the JWKS from the
.well-knowndiscovery URL for every single SSH login.Note this creates a bit of a race condition because
NewVerifyCmdhas been createdNewVerifyCmdexpects the verifier as a parameterSo I've had to change the flow in
main.goto create theVerifyCmdwithout a verifier, then parse the server config, then use the config to create a verifier, then assign that verifier to the right field of theVerifyCmd.Design notes
I've deliberately designed things so that the
FilesystemDiscoveryCachemethods called byopkssh verifycan read and create files under the cache folder, but will never delete anything. I've added a separate commandopkssh cache cleanthat is responsible for cleaning up stale cache entries, it should be run periodically as a cron job.Testing
I've added a unit test for the
FilesystemDiscoveryCacheitself but I'm not sure how to wire in proper end to end testing.Fixes #440