Repository navigation
Replies: 1 comment 1 reply
|
If I'm not mistaken we allow configuring to the interval we recheck. Simplest is to set that to the same or less, but we can easily enough accept a PR that allows configuring to check the header as well. |
1 reply
|
@stianst Thank you for your response. It would be of great value for us if you are able to provide the cache control response header as a configurable option. Do you have a timeline in mind when this can be made available and the target version? Currently we are on 18.0.2 Thank you |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hi,
We are using keycloak to secure a Health IT Electronic Medical Record system. We are in the process of getting our product certified for the latest Health IT requirements, which also includes application security.
One of the requirements is as specified below:
"AUT-SYS-5: The health IT developer demonstrates that the Health IT Module does not cache a JWK Set received via a TLS-protected URL for longer than the “cache-control” header sent by an application indicates."
The above can be found here https://www.healthit.gov/test-method/standardized-api-patient-and-population-services in the 2015 Edition Cures Update and SVAP Test Procedure tab.
The Health IT Module above refers to our authorization server (keycloak). We tried with keycloak version 18.0.2 to set up a client application with a JWKS URL. The JWKS URL is hosted as a REST end point (separate spring boot app) with a Cache Control value of max-age:60 in the response header.
We were expecting keycloak to execute the endpoint at least once after 60 seconds since the initial authentication was performed using the public key in the JWKS url. My understanding is that keycloak uses infinispan for caching public keys.
I looked at the Infinispan Cache configuration and it has a hard coded value for keys in conf/cache-ispn.xml
But according to the certification test steps, this value shall not exceed the value specified in the response header. (60 seconds in this example)
Can someone please help us understand this better and guide us with any alternatives so that our certification timelines are not jeopardized?
(note: I didn't know which category to select, so I put it in Keycloak.X - New store. If this is incorrect please educate me - Thanks)
All reactions