Skip to content

Conversation

Rishav9852Kumar
Copy link
Contributor

@Rishav9852Kumar Rishav9852Kumar commented Oct 1, 2025

Description

This PR adds comprehensive documentation for the new JWT JWKS (JSON Web Key Set) feature in OpenSearch 3.3, which enables direct JWKS endpoint support for JWT authentication without requiring OpenID Connect infrastructure.

What's New

  • Direct JWKS Support: JWT authentication can now use JWKS endpoints directly via the new jwks_uri configuration parameter
  • Automated Key Rotation: Dynamic key management through JWKS endpoints eliminates the need for manual key updates
  • Enhanced Security: Built-in DoS protection with configurable rate limiting, timeouts, and response size restrictions
  • Backward Compatibility: Existing static key configurations continue to work unchanged

Issues Resolved

opensearch-project/security#5578

Version

3.3 & above

Checklist

  • By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
    For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Copy link

github-actions bot commented Oct 1, 2025

Thank you for submitting your PR. The PR states are In progress (or Draft) -> Tech review -> Doc review -> Editorial review -> Merged.

Before you submit your PR for doc review, make sure the content is technically accurate. If you need help finding a tech reviewer, tag a maintainer.

When you're ready for doc review, tag the assignee of this PR. The doc reviewer may push edits to the PR directly or leave comments and editorial suggestions for you to address (let us know in a comment if you have a preference). The doc reviewer will arrange for an editorial review.

@natebower natebower added release-notes PR: Include this PR in the automated release notes v3.3.0 labels Oct 1, 2025
Copy link
Collaborator

@kolchfa-aws kolchfa-aws left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, @Rishav9852Kumar! Some wording suggestions before we can move to editorial review.

Copy link
Collaborator

@kolchfa-aws kolchfa-aws left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, @Rishav9852Kumar! Some suggestions before we can move to editorial review.

@kolchfa-aws kolchfa-aws added the Doc review PR: Doc review in progress label Oct 1, 2025
Rishav9852Kumar and others added 14 commits October 1, 2025 19:47
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Rishav9852Kumar and others added 14 commits October 1, 2025 19:54
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Rishav Kumar <[email protected]>
@kolchfa-aws kolchfa-aws added Editorial review PR: Editorial review in progress and removed Doc review PR: Doc review in progress labels Oct 1, 2025
Copy link
Collaborator

@natebower natebower left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Editorial review

Copy link
Collaborator

@natebower natebower left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@natebower natebower removed the Editorial review PR: Editorial review in progress label Oct 1, 2025
@natebower natebower merged commit 27dbf0b into opensearch-project:main Oct 1, 2025
6 checks passed
@Rishav9852Kumar Rishav9852Kumar deleted the jwt-with-jwks branch October 1, 2025 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release-notes PR: Include this PR in the automated release notes v3.3.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants