Add Jwt cache.

source/extensions/filters/http/jwt_authn/authenticator.cc

@@ -31,7 +31,7 @@ class AuthenticatorImpl : public Logger::Loggable<Logger::Id::jwt>,
 public:
   AuthenticatorImpl(const CheckAudience* check_audience,
                     const absl::optional<std::string>& provider, bool allow_failed,
-                    bool allow_missing, JwksCache& jwks_cache,
+                    bool allow_missing, Cache& jwks_cache,
                     Upstream::ClusterManager& cluster_manager,
                     CreateJwksFetcherCb create_jwks_fetcher_cb, TimeSource& time_source)
       : jwks_cache_(jwks_cache), cm_(cluster_manager),
@@ -65,7 +65,7 @@ class AuthenticatorImpl : public Logger::Loggable<Logger::Id::jwt>,
   void startVerify();
 
   // The jwks cache object.
-  JwksCache& jwks_cache_;
+  Cache& jwks_cache_;
   // the cluster manager object.
   Upstream::ClusterManager& cm_;
 
@@ -81,8 +81,7 @@ class AuthenticatorImpl : public Logger::Loggable<Logger::Id::jwt>,
   // The JWT object.
   std::unique_ptr<::google::jwt_verify::Jwt> jwt_;
   // The JWKS data object
-  JwksCache::JwksData* jwks_data_{};
-
+  Cache::JwksData* jwks_data_{};
   // The HTTP request headers
   Http::HeaderMap* headers_{};
   // The active span for the request
@@ -141,9 +140,9 @@ void AuthenticatorImpl::startVerify() {
 
   jwt_ = std::make_unique<::google::jwt_verify::Jwt>();
   ENVOY_LOG(debug, "{}: Parse Jwt {}", name(), curr_token_->token());
-  Status status = jwt_->parseFromString(curr_token_->token());
-  if (status != Status::Ok) {
-    doneWithStatus(status);
+  jwks_data_->addTokenResult(curr_token_->token(), *jwt_);
+  if (jwks_data_->getJwtStatus() != Status::Ok) {
+    doneWithStatus(jwks_data_->getJwtStatus());
     return;
   }
 
@@ -174,7 +173,7 @@ void AuthenticatorImpl::startVerify() {
   if (jwks_data_->getJwtProvider().clock_skew_seconds() > 0) {
     clock_skew_seconds = jwks_data_->getJwtProvider().clock_skew_seconds();
   }
-  status = jwt_->verifyTimeConstraint(absl::ToUnixSeconds(absl::Now()), clock_skew_seconds);
+  Status status = jwt_->verifyTimeConstraint(absl::ToUnixSeconds(absl::Now()), clock_skew_seconds);
   if (status != Status::Ok) {
     doneWithStatus(status);
     return;
@@ -293,7 +292,7 @@ void AuthenticatorImpl::doneWithStatus(const Status& status) {
 
 AuthenticatorPtr Authenticator::create(const CheckAudience* check_audience,
                                        const absl::optional<std::string>& provider,
-                                       bool allow_failed, bool allow_missing, JwksCache& jwks_cache,
+                                       bool allow_failed, bool allow_missing, Cache& jwks_cache,
                                        Upstream::ClusterManager& cluster_manager,
                                        CreateJwksFetcherCb create_jwks_fetcher_cb,
                                        TimeSource& time_source) {

source/extensions/filters/http/jwt_authn/authenticator.h

@@ -45,7 +45,7 @@ class Authenticator {
   // Authenticator factory function.
   static AuthenticatorPtr create(const ::google::jwt_verify::CheckAudience* check_audience,
                                  const absl::optional<std::string>& provider, bool allow_failed,
-                                 bool allow_missing, JwksCache& jwks_cache,
+                                 bool allow_missing, Cache& jwks_cache,
                                  Upstream::ClusterManager& cluster_manager,
                                  CreateJwksFetcherCb create_jwks_fetcher_cb,
                                  TimeSource& time_source);

source/extensions/filters/http/jwt_authn/filter_config.h

@@ -28,15 +28,15 @@ class ThreadLocalCache : public ThreadLocal::ThreadLocalObject {
   // Load the config from envoy config.
   ThreadLocalCache(const envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication& config,
                    TimeSource& time_source, Api::Api& api) {
-    jwks_cache_ = JwksCache::create(config, time_source, api);
+    jwks_cache_ = Cache::create(config, time_source, api);
   }
 
-  // Get the JwksCache object.
-  JwksCache& getJwksCache() { return *jwks_cache_; }
+  // Get the Cache object.
+  Cache& getJwksCache() { return *jwks_cache_; }
 
 private:
-  // The JwksCache object.
-  JwksCachePtr jwks_cache_;
+  // The Cache object.
+  CachePtr jwks_cache_;
 };
 
 /**

source/extensions/filters/http/jwt_authn/jwks_cache.cc

@@ -1,6 +1,8 @@
 #include "extensions/filters/http/jwt_authn/jwks_cache.h"
 
 #include <chrono>
+#include <memory>
+#include <string>
 
 #include "envoy/common/time.h"
 #include "envoy/extensions/filters/http/jwt_authn/v3/config.pb.h"
@@ -26,7 +28,7 @@ namespace {
 // Default cache expiration time in 5 minutes.
 constexpr int PubkeyCacheExpirationSec = 600;
 
-class JwksDataImpl : public JwksCache::JwksData, public Logger::Loggable<Logger::Id::jwt> {
+class JwksDataImpl : public Cache::JwksData, public Logger::Loggable<Logger::Id::jwt> {
 public:
   JwksDataImpl(const JwtProvider& jwt_provider, TimeSource& time_source, Api::Api& api)
       : jwt_provider_(jwt_provider), time_source_(time_source) {
@@ -63,6 +65,23 @@ class JwksDataImpl : public JwksCache::JwksData, public Logger::Loggable<Logger:
     return setKey(std::move(jwks), getRemoteJwksExpirationTime());
   }
 
+  Status getJwtStatus() override { return jwt_status_; }
+
+  void addTokenResult(const std::string& token, ::google::jwt_verify::Jwt& token_result) override {
+    jwt_status_ = token_result.parseFromString(token);
+    if (jwt_status_ == Status::Ok) {
+      jwt_ = std::make_unique<::google::jwt_verify::Jwt>(token_result);
+    }
+  }
+
+  bool findTokenResult(const std::string& token, ::google::jwt_verify::Jwt& token_result) override {
+    Status status = token_result.parseFromString(token);
+    if (status != Status::Ok) {
+      return false;
+    }
+    return true;
+  }
+
 private:
   // Get the expiration time for a remote Jwks
   std::chrono::steady_clock::time_point getRemoteJwksExpirationTime() const {
@@ -92,9 +111,13 @@ class JwksDataImpl : public JwksCache::JwksData, public Logger::Loggable<Logger:
   TimeSource& time_source_;
   // The pubkey expiration time.
   MonotonicTime expiration_time_;
+  // Jwt object for verified token.
+  std::unique_ptr<::google::jwt_verify::Jwt> jwt_;
+  // A valid error on parsing Jwt.
+  Status jwt_status_;
 };
 
-class JwksCacheImpl : public JwksCache {
+class JwksCacheImpl : public Cache {
 public:
   // Load the config from envoy config.
   JwksCacheImpl(const JwtAuthentication& config, TimeSource& time_source, Api::Api& api) {
@@ -132,10 +155,10 @@ class JwksCacheImpl : public JwksCache {
 
 } // namespace
 
-JwksCachePtr
-JwksCache::create(const envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication& config,
-                  TimeSource& time_source, Api::Api& api) {
-  return JwksCachePtr(new JwksCacheImpl(config, time_source, api));
+CachePtr
+Cache::create(const envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication& config,
+              TimeSource& time_source, Api::Api& api) {
+  return CachePtr(new JwksCacheImpl(config, time_source, api));
 }
 
 } // namespace JwtAuthn

source/extensions/filters/http/jwt_authn/jwks_cache.h

@@ -6,14 +6,17 @@
 #include "envoy/extensions/filters/http/jwt_authn/v3/config.pb.h"
 
 #include "jwt_verify_lib/jwks.h"
+#include "jwt_verify_lib/jwt.h"
 
 namespace Envoy {
 namespace Extensions {
 namespace HttpFilters {
 namespace JwtAuthn {
 
-class JwksCache;
-using JwksCachePtr = std::unique_ptr<JwksCache>;
+using ::google::jwt_verify::Status;
+
+class Cache;
+using CachePtr = std::unique_ptr<Cache>;
 
 /**
  * Interface to access all configured Jwt rules and their cached Jwks objects.
@@ -33,9 +36,9 @@ using JwksCachePtr = std::unique_ptr<JwksCache>;
  *     verifyJwt(jwks_data->getJwksObj(), jwt);
  */
 
-class JwksCache {
+class Cache {
 public:
-  virtual ~JwksCache() = default;
+  virtual ~Cache() = default;
 
   // Interface to access a Jwks config rule and its cached Jwks object.
   class JwksData {
@@ -58,6 +61,14 @@ class JwksCache {
     // Set a remote Jwks.
     virtual const ::google::jwt_verify::Jwks*
     setRemoteJwks(::google::jwt_verify::JwksPtr&& jwks) PURE;
+
+    virtual Status getJwtStatus() PURE;
+
+    virtual void addTokenResult(const std::string& token,
+                                ::google::jwt_verify::Jwt& token_result) PURE;
+
+    virtual bool findTokenResult(const std::string& token,
+                                 ::google::jwt_verify::Jwt& token_result) PURE;
   };
 
   // Lookup issuer cache map. The cache only stores Jwks specified in the config.
@@ -66,7 +77,7 @@ class JwksCache {
   virtual JwksData* findByProvider(const std::string& provider) PURE;
 
   // Factory function to create an instance.
-  static JwksCachePtr
+  static CachePtr
   create(const envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication& config,
          TimeSource& time_source, Api::Api& api);
 };

test/extensions/filters/http/jwt_authn/jwks_cache_test.cc

@@ -26,13 +26,13 @@ class JwksCacheTest : public testing::Test {
   JwksCacheTest() : api_(Api::createApiForTest()) {}
   void SetUp() override {
     TestUtility::loadFromYaml(ExampleConfig, config_);
-    cache_ = JwksCache::create(config_, time_system_, *api_);
+    cache_ = Cache::create(config_, time_system_, *api_);
     jwks_ = google::jwt_verify::Jwks::createFrom(PublicKey, google::jwt_verify::Jwks::JWKS);
   }
 
   Event::SimulatedTimeSystem time_system_;
   JwtAuthentication config_;
-  JwksCachePtr cache_;
+  CachePtr cache_;
   google::jwt_verify::JwksPtr jwks_;
   Api::ApiPtr api_;
 };
@@ -48,7 +48,7 @@ TEST_F(JwksCacheTest, TestSetRemoteJwks) {
   auto& provider0 = (*config_.mutable_providers())[std::string(ProviderName)];
   // Set cache_duration to 1 second to test expiration
   provider0.mutable_remote_jwks()->mutable_cache_duration()->set_seconds(1);
-  cache_ = JwksCache::create(config_, time_system_, *api_);
+  cache_ = Cache::create(config_, time_system_, *api_);
 
   auto jwks = cache_->findByIssuer("https://example.com");
   EXPECT_TRUE(jwks->getJwksObj() == nullptr);
@@ -67,7 +67,7 @@ TEST_F(JwksCacheTest, TestSetRemoteJwksWithDefaultCacheDuration) {
   auto& provider0 = (*config_.mutable_providers())[std::string(ProviderName)];
   // Clear cache_duration to use default one.
   provider0.mutable_remote_jwks()->clear_cache_duration();
-  cache_ = JwksCache::create(config_, time_system_, *api_);
+  cache_ = Cache::create(config_, time_system_, *api_);
 
   auto jwks = cache_->findByIssuer("https://example.com");
   EXPECT_TRUE(jwks->getJwksObj() == nullptr);
@@ -84,7 +84,7 @@ TEST_F(JwksCacheTest, TestGoodInlineJwks) {
   auto local_jwks = provider0.mutable_local_jwks();
   local_jwks->set_inline_string(PublicKey);
 
-  cache_ = JwksCache::create(config_, time_system_, *api_);
+  cache_ = Cache::create(config_, time_system_, *api_);
 
   auto jwks = cache_->findByIssuer("https://example.com");
   EXPECT_FALSE(jwks->getJwksObj() == nullptr);
@@ -98,7 +98,7 @@ TEST_F(JwksCacheTest, TestBadInlineJwks) {
   auto local_jwks = provider0.mutable_local_jwks();
   local_jwks->set_inline_string("BAD-JWKS");
 
-  cache_ = JwksCache::create(config_, time_system_, *api_);
+  cache_ = Cache::create(config_, time_system_, *api_);
 
   auto jwks = cache_->findByIssuer("https://example.com");
   EXPECT_TRUE(jwks->getJwksObj() == nullptr);