Support JWKs for jwt auth key definition

[Sheikah45]

Support for oauth and jwt and oauth authentication mechanisms was recently added which is great!

Currently for jwt authentication the key is provided directly in the configuration yaml. Another option that would be great to support is to allow the admins to supply a url that exposes the json web key set (JWKs). This would allow for a single source of truth for the public keys to check the jwts against and should be supported by any major auth provider. This also helps to centralize any key rotations and keep all the services in sync.

An example of a jwks endpoint is https://hydra.faforever.com/.well-known/jwks.json

[slingamn]

Thanks, I like this idea. There are a few implementation subtleties but nothing too problematic. I think LoadConfig should not preemptively fetch the key; it should be fetched as needed, with caching (and also a mechanism to deduplicate concurrent requests for the uncached key, avoiding thundering-herd pileup after reload/rehash).

One thing I was surprised not to see explicitly addressed in the JWKS spec was a recommended caching lifetime. I guess this can be configurable in ircd.yaml? Rehash should also probably invalidate the cache.

[Sheikah45]

Yes I would agree. In other services that we have the keys are lazily fetched with a configurable cache period as well. I believe some implementations also use the kid in the header, checking if it exists in the cached keys and if not refreshing the keys, but this could lead to a pileup due to mal/misformed jwts. So I don't know if that level is necessary.

And rehash invalidating the cache would still give a nice escape hatch to admins in the case they need to update immediately.

[slingamn]

In the meantime, if you're interested in implementing IRCV3BEARER, here's the current draft:

https://github.com/ircv3/ircv3-specifications/blob/9b06f22551fe6a2faeaaacd5559f97e75ed86f4e/extensions/ircv3bearer.md

Relevant background on SASL in the IRCv3 context is at https://ircv3.net/specs/extensions/sasl-3.1

[Sheikah45]

Thanks, I had seen this earlier and was figuring out what changes we would need to make to the client library we use if any to make it work. So will definitely be giving it a try.