JWKS cache invalidation occ command

[AR2000AR]

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Feature request

Which Nextcloud Version are you currently using: (see administration page)
31.0.9 (docker)

Is your feature request related to a problem? Please describe.
When re-configuring Authentik, the JWKS can change. Nextcloud won't be able to log in for 1h when it happen.

user_oidc/lib/Service/DiscoveryService.php

Line 22 in 1dfc32a

public const INVALIDATE_JWKS_CACHE_AFTER_SECONDS = 3600;

Describe the solution you'd like
An occ command to purge/invalidate the JWKS would be nice as a tool admins can use when re-configuring the upstream OpenID server.

Describe alternatives you've considered
An option to disable the JWKS cache or a force invalidation if a error occured using the cached value like RuntimeException Invalid JWKS: missing "keys" array.

Additional context

• user_oidc 8.0.0 with 0c15a8f 1d51851 manually patched on top (to fix the missing kid bug)
• Authentik 2025.8.4

[julien-nc]

Hey, thanks for reporting this.

force invalidation if a error occured using the cached value like RuntimeException Invalid JWKS: missing "keys" array

I don't think this works in all cases.
It would only retry if the JWKS array is invalid. But the "classic" problematic case you describe is when the keys are renewed. So it's possible that we don't face the RuntimeException but the JWKS is the (outdated) cached one.

It might be hard to automatically invalidate the cache when the IdP JWKS is changed. There is no way user_oidc is aware of that.

Right now there is one (undocumented) way to clear the JWKS cache: Edit the provider in the admin settings, even without changing anything and save it. When pressing the "Update provider" button, the values will be saved and the JWKS cache is invalidated.
You can also edit the provider with occ. Just set the client ID to its current value:

occ user_oidc:provider PROVIDER_IDENTIFIER --clientid UNCHANGED_CLIENT_ID

#1225 adds a section in the README about that.

Wdyt? Any better?