SECAUTH-1475 Calls jwks endpoint with x-zone_uuid header

[nenaraab]

• handles 400 (Bad request) status code
• memorizes the zones that were already accepted or denied for up to 15 minutes
• avoids jwks call in case zone was already accepted and keys are not yet expired
• DOES NOT call jwks endpoints before cache entry gets expired => tokens signed with new token keys are not accepted immediately but after a delay of up to 15 minutes
• test cache handling fro jwks and acceptedZoneIDs
• removes singleFlight here, as GetJWKs is parameterized with zone id
  • -> implement using sync.RWMutex to avoid concurrent remote calls to fetch jwks per zone

[f-blass]

Hi @nenaraab
thanks for the contribution. Is there a specific reason you removed the singleFlight completely? One could add the zone-id in the key of the singleflight to make it unique.

Another possible improvement is the use of map for acceptedZoneIDs to reduce the complexity from O(n) to O(1) in comparison to a slice. One benchmark I found is this one: https://www.darkcoding.net/software/go-slice-search-vs-map-lookup
Best regards
Felix

[nenaraab]

Hi @f-blass
Thanks for your initial review!

The usage of map[string]bool for zoneIDs is a good idea.

In the first draft I’ve added zoneID as key but then I realized that the jwks are the same for all zones (normally up to 20, but for shared ias tenant it could be 1000) that are “assigned” to the same identity tenant… in order to reduce memory I decided to remove the single flight, but maybe we can synchronize the call to identity differently - considering the url AND the x-zone_uuid header…
any idea?

[f-blass]

Looks good now. 👍🏼
For the future we can maybe think about adding a concurrent test to be run with race detector.

[nenaraab]

created two issues:

• [Performance Improvement] differ between GET jwks_url to fetch keys and HEAD jwks_url to check whether zone is accepted #17
• [Test Coverage] test concurrency using race detector  #18