Method Init

be/src/util/jwt-util.cc:758–801

}

Status JWKSMgr::Init(const std::string& jwks_uri, bool jwks_verify_server_certificate,
    const std::string& jwks_ca_certificate, bool is_local_file) {
  Status status;
  jwks_uri_ = jwks_uri;
  jwks_verify_server_certificate_ = jwks_verify_server_certificate;
  jwks_ca_certificate_ = jwks_ca_certificate;
  std::shared_ptr<JWKSSnapshot> new_jwks = std::make_shared<JWKSSnapshot>();
  if (is_local_file) {
    status = new_jwks->LoadKeysFromFile(jwks_uri);
    if (!status.ok()) {
      LOG(ERROR) << "Failed to load JWKS: " << status;
      return status;
    }
    SetJWKSSnapshot(new_jwks);
  } else {
    if (FLAGS_jwks_update_frequency_s <= 0) {
      LOG(WARNING) << "Invalid value for flag jwks_update_frequency_s: "
                   << FLAGS_jwks_update_frequency_s << ", use default value 60.";
      FLAGS_jwks_update_frequency_s = 60;
    }
    if (FLAGS_jwks_pulling_timeout_s <= 0) {
      LOG(WARNING) << "Invalid value for flag jwks_pulling_timeout_s: "
                   << FLAGS_jwks_pulling_timeout_s << ", use default value 10.";
      FLAGS_jwks_pulling_timeout_s = 10;
    }

    bool is_changed = false;
    status = new_jwks->LoadKeysFromUrl(jwks_uri, jwks_verify_server_certificate,
        jwks_ca_certificate, current_jwks_checksum_, &is_changed);
    if (!status.ok()) {
      LOG(ERROR) << "Failed to load JWKS: " << status;
      return status;
    }
    DCHECK(is_changed);
    if (is_changed) SetJWKSSnapshot(new_jwks);

    // Start a working thread to periodically check the JWKS URL for updates.
    RETURN_IF_ERROR(Thread::Create("impala-server", "JWKS-mgr",
        &JWKSMgr::UpdateJWKSThread, this, &jwks_update_thread_));
  }

  if (new_jwks->IsEmpty()) LOG(WARNING) << "JWKS file is empty.";
  return Status::OK();
}

void JWKSMgr::UpdateJWKSThread() {
  std::shared_ptr<JWKSSnapshot> new_jwks;