@Test
    @Configuration("{\n" +
            "  \"requireJWT\": true,\n" +
            "  \"requireSigned\": true,\n" +
            "  \"requireTransportSecurity\": true,\n" +
            "  \"stripTokens\": false,\n" +
            "  \"signingKeyString\": \"http://127.0.0.1:1080/jwks.json\", \n" +
            "  \"kid\": \"null\", \n" +
            "  \"allowedClockSkew\": 0,\n" +
            "  \"requiredClaims\": [{ \"claimName\": \"sub\", \"claimValue\": \"france frichot\" }]\n" +
            "}"
    )
    public void signedValidTokenWithJwksAndExpireCache() throws Throwable {
        // First request with first jwk(s)
        String authVal = "Bearer " + signedToken(PRIVATE_KEY_PEM);
        PolicyTestRequest request = PolicyTestRequest.build(PolicyTestRequestType.GET, "/amirante")
                .header(AUTHORIZATION, authVal);
        PolicyTestResponse response = send(request);
        EchoResponse echo = response.entity(EchoResponse.class);
        Assert.assertNotNull(echo);
        // Ensure we didn't remove the header and it has remained unchanged
        Assert.assertEquals(authVal, echo.getHeaders().get(AUTHORIZATION));

        // Second request will fail because jwk(s) has changed and we have to invalidate the cache
        authVal = "Bearer " + signedToken(PRIVATE_KEY_PEM_2);
        request = PolicyTestRequest.build(PolicyTestRequestType.GET, "/amirante")
                .header(AUTHORIZATION, authVal);
        try {
            send(request);
            // we should never get a valid response
            Assert.fail("Valid response instead of exception");
        } catch (Exception e) {
            assert true;
        }

        // Update jwk(s) on mockserver
        mockServerClient.reset();
        RSAPublicKey rsa = getPublicRsaKey(PUBLIC_KEY_PEM_2);
        mockServerClient.when(request().withMethod("GET").withPath("/jwks.json"))
            .respond(response().withStatusCode(200)
            .withBody("{\"keys\": [\n" +
                    "    {\n" +
                    "      \"kid\": null,\n" +
                    "      \"e\": \""+ Base64.getUrlEncoder().encodeToString(rsa.getPublicExponent().toByteArray()) +"\",\n" +
                    "      \"n\": \""+ Base64.getUrlEncoder().encodeToString(rsa.getModulus().toByteArray()) +"\",\n" +
                    "      \"kty\":\"RSA\",\n" +
                    "      \"alg\": \"RS256\"\n" +
                    "    }\n" +
                    "  ]\n" +
                    "}")
            );

        // Send request again and it will pass
        authVal = "Bearer " + signedToken(PRIVATE_KEY_PEM_2);
        request = PolicyTestRequest.build(PolicyTestRequestType.GET, "/amirante")
                .header(AUTHORIZATION, authVal);
        response = send(request);
        echo = response.entity(EchoResponse.class);
        Assert.assertNotNull(echo);
        // Ensure we didn't remove the header and it has remained unchanged
        Assert.assertEquals(authVal, echo.getHeaders().get(AUTHORIZATION));
    }
@author Marc Savy {@literal <msavy@redhat.com>}
plugins/jwt-policy/src/test/java/io/apiman/plugins/jwt/JWTPolicyTest.java