New OpenIdMetadata signing keys will not be picked up for up to 5 days

[alopix]

Versions

What package version of the SDK are you using.
4.9

(the rest is irrelevant)

Describe the bug

If MSFT adds a new signing key to the OpenIdMetadata it will not be picket up for 5 days and fail Directline Speech connections.

The issue seems to be in OpenIdMetadata:

botbuilder-js/libraries/botframework-connector/src/auth/openIdMetadata.ts

Line 26 in 60ff913

public async getKey(keyId: string): Promise<IOpenIdMetadataKey | null> {

On incoming requests, JwtTokenExtractor will validate the JWT token using the cached public keys loaded via OpenIdMetadata.

MSFT adding (and using!) a new signing key will not be picked up for up to 5 days, which means that if a new signing key is being used, L42/43 will not find it in the cached keys and return undefined, which in turn fails OpenIdMetadata L98 (

botbuilder-js/libraries/botframework-connector/src/auth/jwtTokenExtractor.ts

Line 98 in 60ff913

if (!metadata) {

).

To Reproduce

Steps to reproduce the behavior:
Currently not reproducible as there's no new signing key. But the description should explain how it works.

Expected behavior

My suggestion would be to always check if the signing key actually exists in the cache and refresh the tokens if it doesn't. Only then can you be sure that the signing key is completely invalid.

Screenshots

Additional context

We saw this issue on Saturday for a few hours and restarting our service fixed the issue as it refreshed the memory cache.

[bug]

[EricDahlvang]

@alopix Thank you for the detailed description, and raising this issue.

We are working on a fix, and will keep you updated.

[stevengum]

@EricDahlvang can you also prepare a cherry-pick for the R9 branch?

[EricDahlvang]

@alopix we've merged a fix. I'll let you know when this is released.

[EricDahlvang]

This fix has been released with https://www.npmjs.com/package/botbuilder/v/4.9.3