NimbusJwtDecoderJwkSupport should proactively invalidate JWK cache

[jzheaux]

Summary

NimbusJwtDecoderJwkSupport's JWK cache is only reset when an unrecognized key is part of an incoming JWT.

However, this doesn't account for the case when a key is invalidated by the provider, but no new key is issued.

Actual Behavior

If an existing key is removed from the provider's JWK set, but no new keys are issued, then this JwtDecoder will maintain its cache, potentially admitting JWTs with the invalid key.

Expected Behavior

The Jwt Decoder should refresh its cache actively on a regular basis (e.g. daily) in addition to reacting to unrecognized keys.

Note that this expected behavior could be provided by this Nimbus ticket.

Version

5.1.0.BUILD-SNAPSHOT, 5.0.8

[jzheaux]

Fixed via dfa41f8