Apply JWT decoder timeout properties for AAD and B2C resource servers by rujche · Pull Request #49329 · Azure/azure-sdk-for-java

rujche · 2026-06-01T06:23:12Z

Description

Apply jwtConnectTimeout/jwtReadTimeout properties to RestTemplate used by JWT decoder in AadResourceServerConfiguration and AadB2cResourceServerAutoConfiguration
Remove incorrect @deprecated annotation from timeout properties in AadAuthenticationProperties and AadB2cProperties (the deprecation was based on a RestOperations bean mechanism from PR [FEATURE REQ] Connecting to Azure-AD via proxy #26493 #30456 that was later removed, making the deprecation guidance invalid)
Fix javadoc: correct default value description from '500s' to '500ms'
Add tests for default and custom timeout property values

All SDK Contribution checklist:

The pull request does not introduce [breaking changes]
CHANGELOG is updated for new features, bug fixes or other significant changes.
I have read the contribution guidelines.

General Guidelines and Best Practices

Title of the pull request is clear and informative.
There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

Pull request includes test coverage for the included changes.

@deprecated

- Apply jwtConnectTimeout/jwtReadTimeout properties to RestTemplate used by JWT decoder in AadResourceServerConfiguration and AadB2cResourceServerAutoConfiguration - Remove incorrect @deprecated annotation from timeout properties in AadAuthenticationProperties and AadB2cProperties (the deprecation was based on a RestOperations bean mechanism from PR #30456 that was later removed, making the deprecation guidance invalid) - Fix javadoc: correct default value description from '500s' to '500ms' - Add tests for default and custom timeout property values

Copilot

Pull request overview

This PR updates Spring Cloud Azure (autoconfigure) resource-server support so the jwtConnectTimeout / jwtReadTimeout properties are actually applied to the HTTP client used for JWK retrieval, and cleans up related property metadata and tests.

Changes:

Apply configured JWT connect/read timeouts to the RestTemplate/RestTemplateBuilder used by AAD and B2C JWT decoding/JWK retrieval.
Remove incorrect @Deprecated markers on JWT timeout/size-limit properties and fix the documented default timeout unit.
Add unit tests for default/custom timeout property binding.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 24 comments.

Show a summary per file

File	Description
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aadb2c/configuration/AadB2cResourceServerAutoConfiguration.java	Applies B2C timeout properties to the `RestTemplateBuilder` used for JWK retrieval.
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.java	Applies AAD timeout properties to the `RestTemplate` passed into `NimbusJwtDecoder`.
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aadb2c/configuration/properties/AadB2cProperties.java	Removes deprecations and updates Javadoc defaults for JWT timeout/size-limit properties.
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aad/configuration/properties/AadAuthenticationProperties.java	Removes deprecations and updates Javadoc defaults for JWT timeout/size-limit properties.
sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/aadb2c/configuration/AadB2cResourceServerAutoConfigurationTests.java	Adds tests for default/custom B2C timeout property values.
sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfigurationTests.java	Adds tests for default/custom AAD timeout property values.

…ests

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

…on timeout fields

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

rujche · 2026-06-01T07:52:43Z

/azp run java - spring - tests

azure-pipelines · 2026-06-01T07:53:06Z

Azure Pipelines successfully started running 1 pipeline(s).

abjugard · 2026-06-01T09:14:30Z

What's a rough timeframe for this to make it to a release of com.azure.spring spring-cloud-azure-dependencies?

rujche · 2026-06-02T01:06:24Z

@abjugard

What's a rough timeframe for this to make it to a release of com.azure.spring spring-cloud-azure-dependencies?

Current plan is releasing it before the end of June.

Netyyyy

LGTM.

abjugard · 2026-06-02T09:25:21Z

@rujche I found this ticket which was closed without resolution: #42159 which made me look deeper into this.

Both before and after this PR, I am not sure that the code that sets up the cache was correctly adapted to upstream changes in Nimbus, it appears to me that the relevant keys for configuring the cache (spring.cloud.azure.active-directory.jwk-set-cache-lifespan and .jwk-set-cache-refresh-time) are only read by a JWKSetCache Bean, which is something RemoteJWKSet uses, but RemoteJWKSet is not being used when the NimbusJwtDecoder is built, that is done by calling NimbusJwtDecoder.withJwkSetUri at

azure-sdk-for-java/sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.java

Lines 58 to 63 in 79fb0dd

    
           NimbusJwtDecoder nimbusJwtDecoder = NimbusJwtDecoder 
        
               .withJwkSetUri(identityEndpoints.getJwkSetEndpoint()) 
        
               .restOperations(createRestTemplate(restTemplateBuilder 
        
                   .connectTimeout(aadAuthenticationProperties.getJwtConnectTimeout()) 
        
                   .readTimeout(aadAuthenticationProperties.getJwtReadTimeout()))) 
        
               .build();

It seems to me that we would have to call .cache before line 63 (.build()) there or do something like:

JWKSource<SecurityContext> jwkSource = JWKSourceBuilder
        .create(URI.create(identityEndpoints.getJwkSetEndpoint()).toURL())
        .cache(aadProps.getJwkSetCacheLifespan().toMillis(), aadProps.getJwtConnectTimeout().toMillis())
        .refreshAheadCache(aadProps.getJwkSetCacheRefreshTime().toMillis(), true)
        .build();

NimbusJwtDecoder nimbusJwtDecoder = NimbusJwtDecoder
        .withJwkSource(jwkSource)
        .build();

in order to wire the NimbusJwtDecoder with cache.

If you want me to I can open a separate ticket for this?

rujche · 2026-06-03T02:20:40Z

Hi, @abjugard . Thanks for the comment. I opened this issue (#42159) and created a new PR (#49356), please help to review when you are available.

abjugard · 2026-06-03T08:30:18Z

@rujche Looks good to me as a fix for the unused cache bug.

Improvement suggestion: enable the use of a Bean-injected customizer for the JWKSourceBuilder using the customizer pattern, allowing users to supply their own advanced configurations.

Here's an example of how this looks with Jackson, this customizer bean is then used whenever a JsonMapper is constructed:

@Configuration
class JacksonConfig {

    @Bean
    JsonMapperBuilderCustomizer jacksonCustomizer() {
        return builder -> builder
                .enable(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES)
                .enable(MapperFeature.ACCEPT_CASE_INSENSITIVE_ENUMS)
                .disable(DeserializationFeature.FAIL_ON_IGNORED_PROPERTIES)
                .disable(DateTimeFeature.WRITE_DATES_AS_TIMESTAMPS)
                .changeDefaultPropertyInclusion(inclusion ->
                        inclusion.withValueInclusion(JsonInclude.Include.NON_NULL));
    }
}

Alternatively look at the non-deprecated mechanisms for setting up the JWK source in nimbus, there are a number of nice to have features supported there, e.g. .outageTolerant, .retrying, along with background fetching, which all serve to improve the resilience of the components that rely on this, which are currently out of users reach when using the auto-configuration provided here, meaning they would have to configure JWK source manually in order to use them. The alternative to the customizer suggestion would be to expose individual properties for each of these.

rujche · 2026-06-04T01:34:30Z

Hi, @abjugard . Thanks for the review and suggestion.

Improvement suggestion: enable the use of a Bean-injected customizer for the JWKSourceBuilder using the customizer pattern, allowing users to supply their own advanced configurations.

In this PR (#49356), ,JWKSourceBuilder is not used to create a bean, do you mean customizer for JwtDecoder?

Copilot AI review requested due to automatic review settings June 1, 2026 06:23

rujche requested review from a team, Netyyyy, moarychan and saragluna as code owners June 1, 2026 06:23

Copilot started reviewing on behalf of rujche June 1, 2026 06:23 View session

github-actions Bot added the azure-spring All azure-spring related issues label Jun 1, 2026

Update CHANGELOG for JWT decoder timeout fix (#49329)

dd22f80

rujche self-assigned this Jun 1, 2026

rujche added this to Spring Cloud Azure Jun 1, 2026

github-project-automation Bot moved this to Todo in Spring Cloud Azure Jun 1, 2026

rujche moved this from Todo to In Progress in Spring Cloud Azure Jun 1, 2026

rujche added this to the 2026-06 milestone Jun 1, 2026

rujche mentioned this pull request Jun 1, 2026

Add timeouts for JWT decoder in AadResourceServerConfiguration #49312

Closed

6 tasks

rujche added azure-spring-aad Spring active directory related issues. azure-spring-aad-b2c Spring active directory b2c related issues. bug This issue requires a change to an existing behavior in the product in order to be resolved. labels Jun 1, 2026

Copilot AI reviewed Jun 1, 2026

View reviewed changes

Address PR review: use {@value} javadoc tags and strengthen timeout t…

945ea41

…ests

rujche requested a review from Copilot June 1, 2026 07:06

Copilot started reviewing on behalf of rujche June 1, 2026 07:06 View session

Copilot AI reviewed Jun 1, 2026

View reviewed changes

Comment thread ...loud/autoconfigure/implementation/aad/configuration/AadResourceServerConfigurationTests.java Outdated

Comment thread ...onfigure/implementation/aadb2c/configuration/AadB2cResourceServerAutoConfigurationTests.java Outdated

Replace deprecated RemoteJWKSet constants with JWKSourceBuilder

e7e55fd

rujche requested a review from Copilot June 1, 2026 07:19

Copilot started reviewing on behalf of rujche June 1, 2026 07:19 View session

Copilot AI reviewed Jun 1, 2026

View reviewed changes

Fix test failures: unwrap CachingJWKSetSource chain and handle Durati…

3ffc60f

…on timeout fields

rujche requested a review from Copilot June 1, 2026 07:33

Copilot started reviewing on behalf of rujche June 1, 2026 07:33 View session

Copilot AI reviewed Jun 1, 2026

View reviewed changes

bigdaddykane18 approved these changes Jun 1, 2026

View reviewed changes

Netyyyy approved these changes Jun 2, 2026

View reviewed changes

rujche merged commit b196db5 into main Jun 2, 2026
84 checks passed

rujche deleted the rujche/main/add-timeout-for-JwtDecoder branch June 2, 2026 01:47

github-project-automation Bot moved this from In Progress to Done in Spring Cloud Azure Jun 2, 2026

This was referenced Jun 3, 2026

Add Support for JWK Cache Configuration in Resource Server #42159

Open

fix: jwk-set-cache related properties are not take effect #49356

Open

Conversation

rujche commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

All SDK Contribution checklist:

General Guidelines and Best Practices

Testing Guidelines

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

rujche commented Jun 1, 2026

Uh oh!

azure-pipelines Bot commented Jun 1, 2026

Uh oh!

abjugard commented Jun 1, 2026

Uh oh!

rujche commented Jun 2, 2026

Uh oh!

Netyyyy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

abjugard commented Jun 2, 2026

Uh oh!

rujche commented Jun 3, 2026

Uh oh!

abjugard commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rujche commented Jun 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

rujche commented Jun 1, 2026 •

edited

Loading

abjugard commented Jun 3, 2026 •

edited

Loading