When the Kong OIDC plugin throws a 401 error following an update to the IDP signer certificate, it is typically due to the plugin’s cache not being updated with the new certificate information. This can happen when the kid (Key ID) in the JWKS (JSON Web Key Set) does not change even though the signing certificate has been updated. The OIDC plugin’s cache expects either a new kid or a new issuer to trigger a recrawl of the JWKS endpoint.
There is a short-term and long-term solution to this issue below:
- The short-term solution is to disable and re-enable the plugin, this will force a cache rebuild and allow the Kong Gateway to recrawl for the latest JWKS. If there are many instances of this plugin affected, then the quickest method will be to delete the cache system-wide with either a restart of the node or a cURL command to the
/openid-connect/issuers API endpoint. An example request to that endpoint: curl -X DELETE http://<admin-hostname>:8001/openid-connect/issuers
- The long-term solution is to discontinue use of static key IDs. Although employing static
kid values in the JSON Web Key Set (JWKS) is allowed, it introduces challenges and is not aligned with industry-recommended practices. The preferred strategy is using dynamic kid values as they are automatically rotated to a different value when the signing certificate or other relevant details are updated. This approach not only enhances security but also ensures automatic refreshment of client-side caching without manual intervention. If you continue to use static kid values, then you will need to incorporate the cache clearing steps above in step 1 into your process whenever the JWKS are modified or signing certificates are changed.