Signingkeys: Add local cache (#76234)

* IDForwarding: change audience to be prefixed by org and remove JTI

* IDForwarding: Construct new signer each time we want to sign a token.

* SigningKeys: Simplify storage layer and move logic to service

* SigningKeys: Add private key to local cache

pkg/services/auth/idimpl/service.go

@@ -3,7 +3,6 @@ package idimpl
 import (
 	"context"
 	"fmt"
-	"strconv"
 	"time"
 
 	"github.com/go-jose/go-jose/v3/jwt"
@@ -67,10 +66,9 @@ func (s *Service) SignIdentity(ctx context.Context, id identity.Requester) (stri
 	now := time.Now()
 	token, err := s.signer.SignIDToken(ctx, &auth.IDClaims{
 		Claims: jwt.Claims{
-			ID:       identifier,
 			Issuer:   s.cfg.AppURL,
-			Audience: jwt.Audience{strconv.FormatInt(id.GetOrgID(), 10)},
-			Subject:  fmt.Sprintf("%s:%s", namespace, identifier),
+			Audience: getAudience(id.GetOrgID()),
+			Subject:  getSubject(namespace, identifier),
 			Expiry:   jwt.NewNumericDate(now.Add(tokenTTL)),
 			IssuedAt: jwt.NewNumericDate(now),
 		},
@@ -102,6 +100,14 @@ func (s *Service) hook(ctx context.Context, identity *authn.Identity, _ *authn.R
 	return nil
 }
 
+func getAudience(orgID int64) jwt.Audience {
+	return jwt.Audience{fmt.Sprintf("org:%d", orgID)}
+}
+
+func getSubject(namespace, identifier string) string {
+	return fmt.Sprintf("%s:%s", namespace, identifier)
+}
+
 func prefixCacheKey(key string) string {
 	return fmt.Sprintf("%s-%s", cachePrefix, key)
 }

pkg/services/auth/idimpl/signer.go

@@ -11,40 +11,20 @@ import (
 	"github.com/grafana/grafana/pkg/services/signingkeys"
 )
 
-const idSignerKeyPrefix = "id"
+const (
+	keyPrefix   = "id"
+	headerKeyID = "kid"
+)
 
 var _ auth.IDSigner = (*LocalSigner)(nil)
 
 func ProvideLocalSigner(keyService signingkeys.Service, features featuremgmt.FeatureToggles) (*LocalSigner, error) {
-	if features.IsEnabled(featuremgmt.FlagIdForwarding) {
-		id, key, err := keyService.GetOrCreatePrivateKey(context.Background(), idSignerKeyPrefix, jose.ES256)
-		if err != nil {
-			return nil, err
-		}
-
-		// FIXME: Handle key rotation
-		signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.ES256, Key: key}, &jose.SignerOptions{
-			ExtraHeaders: map[jose.HeaderKey]interface{}{
-				"kid": id,
-			},
-		})
-
-		if err != nil {
-			return nil, err
-		}
-
-		return &LocalSigner{
-			features: features,
-			signer:   signer,
-		}, nil
-	}
-
-	return &LocalSigner{features: features}, nil
+	return &LocalSigner{features, keyService}, nil
 }
 
 type LocalSigner struct {
-	signer   jose.Signer
-	features featuremgmt.FeatureToggles
+	features   featuremgmt.FeatureToggles
+	keyService signingkeys.Service
 }
 
 func (s *LocalSigner) SignIDToken(ctx context.Context, claims *auth.IDClaims) (string, error) {
@@ -52,7 +32,12 @@ func (s *LocalSigner) SignIDToken(ctx context.Context, claims *auth.IDClaims) (s
 		return "", nil
 	}
 
-	builder := jwt.Signed(s.signer).Claims(claims.Claims)
+	signer, err := s.getSigner(ctx)
+	if err != nil {
+		return "", err
+	}
+
+	builder := jwt.Signed(signer).Claims(claims.Claims)
 
 	token, err := builder.CompactSerialize()
 	if err != nil {
@@ -61,3 +46,20 @@ func (s *LocalSigner) SignIDToken(ctx context.Context, claims *auth.IDClaims) (s
 
 	return token, nil
 }
+
+func (s *LocalSigner) getSigner(ctx context.Context) (jose.Signer, error) {
+	id, key, err := s.keyService.GetOrCreatePrivateKey(ctx, keyPrefix, jose.ES256)
+	if err != nil {
+		return nil, err
+	}
+
+	signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.ES256, Key: key}, &jose.SignerOptions{
+		ExtraHeaders: map[jose.HeaderKey]any{headerKeyID: id},
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return signer, nil
+}