Add jwks expiration header

[bostandyksoft]

Expected Behavior
According to OpenID Connect specification
10.2.1. Rotation of Asymmetric Encryption Keys
https://openid.net/specs/openid-connect-core-1_0.html#RotateEncKeys

oauth2/jwks endpoint response SHOULD contain some information about keys expiring. So we need a way to customize the response-building process. Either an interceptor or inheritance mechanism

Current Behavior
NimbusJwkSetEndpointFilter does not provide any mechanism to send this information

[jgrandja]

@bostandyksoft

You referenced 10.2.1. Rotation of Asymmetric Encryption Keys but I'm curious exactly what you are trying to achieve as Spring Authorization Server does not currently support JWE so it's not clear to me how you intend on using JWE.

Can you please provide specific details on your use case?

[bostandyksoft]

Hi. Excuse me.
I meant 10.1.1 paragraph. About signing keys. There is also mention of rolling keys
"Keys can be rolled over by periodically adding new keys to the JWK Set at the jwks_uri location"

[jgrandja]

@bostandyksoft Spring Authorization Server uses a JWKSource @Bean (required) for obtaining the signing key. The backing implementation of JWKSource is responsible for providing key rotation capability.

We do have an open issue gh-544 that will demonstrate how to provide a JWKSource @Bean that implements a key rotation strategy.

I'll close this issue as a duplicate of gh-544.