jose4j是否会自动处理Azure签名密钥翻转？

Question

我在我的Java应用程序中实现了jose4j，以验证Azure发布的访问令牌的签名。这个应用程序运行得很好，但是我偶然看到了这篇关于Signing Key rollover的文档。在使用HttpsJwksVerificationKeyResolver时，jose4j会自动处理它吗

我目前正在使用以下代码片段来构建JwtConsumer

String azureKeyDiscoveryUrl =
                "https://login.microsoftonline.com/{my-tenant-id}/discovery/keys";
HttpsJwks azureKeyDiscovery = new HttpsJwks(azureKeyDiscoveryUrl);

HttpsJwksVerificationKeyResolver azureJwksKeyResolver = new HttpsJwksVerificationKeyResolver(azureKeyDiscovery);

JwtConsumer azureJwtConsumer = new JwtConsumerBuilder()
                .setRequireExpirationTime()
                .setAllowedClockSkewInSeconds(30)
                .setRequireIssuedAt()
                .setRequireNotBefore()
                .setVerificationKeyResolver(azureJwksKeyResolver)
                .setExpectedAudience("my-audience")
                .setJwsAlgorithmConstraints(new AlgorithmConstraints(
                        AlgorithmConstraints.ConstraintType.WHITELIST, AlgorithmIdentifiers.RSA_USING_SHA256))
                .build();
JwtClaims claims = azureJwtConsumer.processToClaims("tokenStringHere");

Answer 1

是的，假设Azure对https://login.microsoftonline.com/{my-tenant-id}/discovery/keys端点做了正确/合理的事情，我认为他们确实是这样做的，它会工作的。