Remove Deprecated Usages of RemoteJWKSet

[kwondh5217]

close gh-16251

[jzheaux]

Thanks, @kwondh5217, for the PR! I've left some feedback inline.

[jzheaux]

Since we are doing our own implementation of JWKSource, it should be possible to use RestOperations and Cache directly instead of implementing additional Nimbus interfaces.

[kwondh5217]

Hi @jzheaux, I have a couple of questions regarding the feedback:

1. Regarding "Since we are doing our own implementation of JWKSource, it should be possible to use RestOperations and Cache directly instead of implementing additional Nimbus interfaces":

   Does this mean we should replace the custom SpringJWKSetCache implementation with direct usage of Spring's Cache?

2. I am also considering whether to streamline the code by either:

   • Using RestOperations directly, or
   • Using RestOperationsResourceRetriever

Below are the two possible approaches:

• Direct RestOperations:

  private static final class SpringURLBasedJWKSource<C extends SecurityContext> implements JWKSource<C> {
  
      private final RestOperations restOperations;
  
      // Implementation logic uses restOperations directly
  }

• Using ResourceRetriever:

  private static final class SpringURLBasedJWKSource<C extends SecurityContext> implements JWKSource<C> {
  
      private final ResourceRetriever resourceRetriever;
  
      // Implementation logic continues to leverage resourceRetriever
  }

Would it be better to reuse the already implemented RestOperationsResourceRetriever, or to use RestOperations directly within the class?

If we go with the direct RestOperations approach, should the RestOperationsResourceRetriever implementation be removed entirely?

Thank you for your feedback!

[jzheaux]

Let's update this so that the member variable is set to NoOpCache. In this way, the null checking here and downstream is unnecessary.

[holzerch]

Could you please replace this synchronized statement with an ReentrantLock. Otherwise this could cause thread pinning with virtual threads.

[kwondh5217]

@holzerch Thank you for the feedback!
I’ll replace the synchronized block with a ReentrantLock as suggested.