Jwks doesn't have key to match kid or alg from Jwt

[xmath279]

Description:

When OIDC provider rotates the keys, Envoy fails to refetch the keys and returns the following error:

Jwks doesn't have key to match kid or alg from Jwt

Repro steps:

Create a security policy with JWKS using a provider that rotates keys (for example, Zitadel). Wait for the key to expire and try the route associated with the security policy.

Environment:

Envoy Gateway 1.1.0
Envoy 1.31.0

Notes

The OpenID Connect spec specifies that the verifier should try to refetch the keys if it encounters an unknown key, see: https://openid.net/specs/openid-connect-core-1_0.html#RotateSigKeys

[arkodg]

cc @zhaohuabing @denniskniep

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.