<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
</div>
<blockquote type="cite">
<div>
On 16/11/2022 17:31 EET Felix Auringer <<a href="mailto:felix.auringer@giz.berlin">felix.auringer@giz.berlin</a>> wrote:
</div>
<div>
</div>
<div>
</div>
<div>
Hello,
</div>
<div>
</div>
<div>
<<a href="https://doc.dovecot.org/configuration_manual/authentication/oauth2/#local-validation" target="_blank" rel="noopener">https://doc.dovecot.org/configuration_manual/authentication/oauth2/#local-validation</a>>
</div>
<div>
describes how to set up local validation for OAUTH2 with dovecot. This
</div>
<div>
works fine as long as the keys are not rotated. In my experience, it is
</div>
<div>
common for a client to try to validate a token with the cached key and
</div>
<div>
update the cached keys when the local validation fails (e.g. via the
</div>
<div>
/auth/realms/<realm>/protocol/openid-connect/certs endpoint in
</div>
<div>
Keycloak). This way, the client does not need to fetch new keys
</div>
<div>
periodically but only when the old ones expired. If I understand it
</div>
<div>
correctly, Dovecot reads the keys from a defined path but does not care
</div>
<div>
how to update them. Did you have a nice way in mind how the keys should
</div>
<div>
be refreshed when deciding not to do that in dovecot? Are you planning
</div>
<div>
to add automatic refreshing of local validation keys to dovecot?
</div>
<div>
I am running dovecot in Docker and one way would be a cron job on the
</div>
<div>
host that fetches new keys and updates the files inside the container
</div>
<div>
via docker exec. It would work but it's not really a nice solution
</div>
<div>
because from outside dovecot, the information whether the old keys are
</div>
<div>
no longer valid, is not available and the whole process needs to run
</div>
<div>
periodically (and thus way more often than actually necessary).
</div>
<div>
</div>
<div>
Best regards,
</div>
<div>
Felix Auringer
</div>
<div>
---
</div>
<div>
Gesellschaft für interkulturelles
</div>
<div>
Zusammenleben gGmbH (GIZ)
</div>
<div>
Felix Auringer
</div>
<div>
IT
</div>
<div>
Reformationsplatz 2
</div>
<div>
13597 Berlin
</div>
<div>
</div>
<div>
Tel: 030/513 0100 00; Fax: 030/513 0100 09
</div>
<div>
www.giz.berlin; <a href="mailto:felix.auringer@giz.berlin">felix.auringer@giz.berlin</a>
</div>
<div>
</div>
<div>
Amtsgericht Charlottenburg HRB 200872 B
</div>
<div>
Geschäftsführerin: Dr. Britta Marschke
</div>
</blockquote>
<div class="default-style">
</div>
<div class="default-style">
You could also mount a key volume and only update that with cron. Alternatively you need a dict protocol based solution.
</div>
<div class="io-ox-signature">
<pre>---
Aki Tuomi</pre>
</div>
</body>
</html>