https://issues.apache.org/jira/browse/SOLR-18211

Motivation

org.bitbucket.b_c:jose4j is unmaintained — its last release was March 2024 and it is a single-maintainer project. com.nimbusds:nimbus-jose-jwt is a well-maintained, widely-used JOSE/JWT library that was already present as a
test dependency in this module.

Changes

JWTIssuerConfig

• Replace JsonWebKeySet / JsonWebKey with nimbus JWKSet / JWK
• Replace HttpsJwks with a new inner class JwkSetFetcher wrapping nimbus's ResourceRetriever with synchronized caching and a configurable TTL
• Custom ResourceRetriever implementation preserves existing behaviour: trusted SSL certificates and hostname verification bypass for localhost endpoints

IssuerAwareJWSKeySelector (previously JWTVerificationkeyResolver)

• Renamed to reflect the nimbus interface it now implements (JWSKeySelector<SecurityContext>)
• Added IssuerContext implements SecurityContext to thread the JWT's (unverified) issuer claim from the payload to the key selector, enabling per-issuer key lookup
• Key selection uses JWKSelector + JWKMatcher.forJWSHeader() to match on kid and algorithm

JWTAuthPlugin

• Replace JwtConsumer / JwtConsumerBuilder with DefaultJWTProcessor<SecurityContext> + DefaultJWTClaimsVerifier
• JWT is pre-parsed (without signature verification) to extract the issuer and enforce the algorithm allowlist before full processing
• Explicit issuer value validation: when at least one issuer is configured with an iss value, the token's issuer must match

Testing

All 65 existing tests pass unchanged (1 skipped). Passes forbiddenApis, ecjLint, spotlessCheck, and validateLogCalls.

To further lower the risk of this migration, 13 new unit tests are added across the three test classes:

• IssuerAwareJWSKeySelectorTest — covers all previously untested branches of resolveIssuerConfig(): null issuer with single multiple issuers, unrecognised issuer with single/multiple issuers, and correct materialisation of EC keys as ECPublicKey
• JWTAuthPluginTest — covers: requireIssuer=false does not bypass issuer value validation; requireIssuer=false with no issuer in token or config authenticates successfully; scope claim expressed as a JSON array; asConfig() JWK round-trip produces a functional plugin; clock-skew tolerance (25 s expired → authenticated; 35 s expired → JWT_EXPIRED)
• JWTIssuerConfigTest — covers: parseJwkSet with a bare single-JWK map (no "keys" wrapper); JwkSetFetcher refresh reprieve suppressing a second call within the window; JwkSetFetcher cache expiry triggering a re-fetch

Docs

While reviewing the code for this migration, several bugs were found in jwt-authentication-plugin.adoc and fixed:

• blockUnknown default is false, not true — the ref guide has documented the default as true since apache/lucene-solr#805 (SOLR-13649), a docs-only PR merged in 9.0 that appears to have introduced the wrong default. The code has always used getOrDefault(PARAM_BLOCK_UNKNOWN, false), meaning unauthenticated requests pass through unless blockUnknown is explicitly set to true. The intro paragraph ("The plugin will by default require a valid JWT for all traffic") has also been corrected to match.
• aud default — documented as "Uses clientId if configured"; the code has no such fallback. If aud is not set, audience validation is skipped entirely.
• adminUiScope fallback — documented as falling back to the first scope entry; the code has a second fallback to the hardcoded string "solr" that was not mentioned.
• Clock skew tolerance — a 30-second exp tolerance is applied by the plugin but was not documented anywhere; added a note to the requireExp row.

Disclaimer: This migration is done with help of Claude Code.