Allow to configure the JWKS refresh settings

This exposes a couple for knobs for the jwks keyfunc module to adjust
timeout and refresh intervals.

services/proxy/pkg/config/config.go

@@ -94,6 +94,14 @@ type OIDC struct {
 	Insecure                bool          `yaml:"insecure" env:"OCIS_INSECURE;PROXY_OIDC_INSECURE" desc:"Disable TLS certificate validation for connections to the IDP. Note that this is not recommended for production environments."`
 	AccessTokenVerifyMethod string        `yaml:"access_token_verify_method" env:"PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD" desc:"Sets how OIDC access tokens should be verified. Possible values: 'none', which means that no special validation apart from using it for accessing the IPD's userinfo endpoint will be done. Or 'jwt', which tries to parse the access token as a jwt token and verifies the signature using the keys published on the IDP's 'jwks_uri'."`
 	UserinfoCache           UserinfoCache `yaml:"user_info_cache"`
+	JWKS                    JWKS          `yaml:"jwks"`
+}
+
+type JWKS struct {
+	RefreshInterval   uint64 `yaml:"refresh_interval" env:"PROXY_OIDC_JWKS_REFRESH_INTERVAL" desc:"The interval for refreshing the JWKS in the background via a new HTTP request to the IDP in minutes."`
+	RefreshTimeout    uint64 `yaml:"refresh_timeout" env:"PROXY_OIDC_JWKS_REFRESH_TIMEOUT" desc:"The timeout, in seconds, for and outgoing JWKS request."`
+	RefreshRateLimit  uint64 `yaml:"refresh_limit" env:"PROXY_OIDC_JWKS_REFRESH_RATE_LIMIT" desc:"Limits the rate at which refresh requests are performed for unknown keys in seconds. (To prevent malicious client from imposing high network load on the IDP via ocis)"`
+	RefreshUnknownKID bool   `yaml:"refresh_unknown_kid" env:"PROXY_OIDC_JWKS_REFRESH_UNKNOWN_KID" desc:"If true the JWKS refresh request will occur every time an unknown key id (kid) is seen. Always set a 'refresh_limit' when enabling this"`
 }
 
 // UserinfoCache is a TTL cache configuration.

services/proxy/pkg/config/defaults/defaultconfig.go

@@ -41,6 +41,12 @@ func DefaultConfig() *config.Config {
 				Size: 1024,
 				TTL:  10,
 			},
+			JWKS: config.JWKS{
+				RefreshInterval:   60, // minutes
+				RefreshRateLimit:  60, // seconds
+				RefreshTimeout:    10, // seconds
+				RefreshUnknownKID: true,
+			},
 		},
 		PolicySelector: nil,
 		Reva: &config.Reva{