callout: try to renew jwt when expire #4814
Conversation
ramonberrutti
force-pushed
the
callout-revalidate-jwt
branch
from
28b2105
to
5985098
Compare
| @@ -289,7 +289,7 @@ func (s *Server) processClientOrLeafCallout(c *client, opts *Options) (authorize | |||
| } | |||
|
|
|||
| // Check if we need to set an auth timer if the user jwt expires. | |||
| c.setExpiration(arc.Claims(), expiration) | |||
| c.setRenewal(arc.Claims(), expiration) | |||
There was a problem hiding this comment.
This should have a buffer imo. So if expiration is say 30mins, we should ask for a renewal at some point before 30mins in case auth callout service is slow to respond. So some percentage, say 10-15% (so for 30mins would be 3mins, so timer would be 27m not 30m). We should also set a max offset for smaller ttls.
There was a problem hiding this comment.
Do we want to retry for slow responds?
There was a problem hiding this comment.
I do not believe so, at least to start. Just have the buffer so we are not cutting things too close.
ramonberrutti
force-pushed
the
callout-revalidate-jwt
branch
from
5985098
to
98df5fc
Compare
|
Any updates here or are we good for final review? |
Sorry, we have moved to another solution and forgotten about it. I am going to update the PR tomorrow |
When a jwt with expiration expires, we are going to request request a new one or disconnect the client.
Signed-off-by: Ramon Berrutti ramonberrutti@gmail.com