Package improvements

[zoltanpeto]

Hey guys,

I'm working on implementing a REST API secured by an Okta Authorization server. Although this package provides everything I need for development, I think I'll face some issues when it comes to production usage. My concerns are the following:

1. JWK usage: the package currently loads the JWKs via each Adaptor implementation. This is not only a duplication of concerns (both existing adaptor implementations need to implement the fetching of keys even though it is the same process), but it also make it impossible to implement a caching layer so the keys are not loaded from Okta each time a token needs to be verified: the verifier currently makes 2 calls to okta during each request, first to get the jwk url from the authorization server metadata and then to get the keys from that url.
2. Since Okta access tokens always contain cid claim, according to current implementation of JwtVerifier it must always be verified. My only problem with that is the verifier only supports a single client ID , which means all the consumers of my API must obtain the token using the same Okta app.

I'm wondering if I'm exaggerating these problems due to my limited experience with Okta and Oauth, or they are valid concerns?

I am happy to contribute to this package if that the following improvements should be made:

1. inject KeyRepository into JwtVerifier that is responsible for fetching (and caching) JWKs, instead of using Adaptor::getKeys() method.
2. support passing an array of client IDs to JwtVerifier so it verifies tokens issued for any of the allowed clients.

[bretterer]

Hi @zoltanpeto - Thank you for your feedback here. We are always open to improvements of this library from the community and these sounds like they could be useful. We do have a list of claims that we need to be aware of and verify them which is why CID is always verified. We do have a ticket to update the verifier to allow for multiple CID's on our backlog to address. If you have an implementation you would like to share, I would be more than happy to take a look at it