OAuth2 JWT: JWKS download fails with the default 4 KiB HTTP response buffer when using Microsoft Entra ID #12679

Problem

Fluent Bit's HTTP input cannot retrieve a Microsoft Entra ID JWKS document when the HTTP response exceeds the internal client's default 4 KiB buffer limit.

The JWKS fetch path does not expose a configuration option to increase this limit. This requires an additional proxy container solely to reduce the JWKS response size before Fluent Bit receives it.

Environment

• Fluent Bit: 5.1.3
• Deployment: Kubernetes DaemonSet using the Fluent Bit Helm chart
• Input: http
• Authentication: OAuth2 JWT validation against Microsoft Entra ID
• Source inspection: the same limitation remains in the v5.1.5 JWKS fetch implementation

Scenario

We use the HTTP input to receive application logs. Applications provide a bearer token issued by Microsoft Entra ID, and Fluent Bit validates it using the configured issuer and JWKS endpoint.

The Entra ID JWKS response contains multiple signing keys. Each key may include an x5c certificate chain in addition to RSA public-key parameters such as n and e.

These certificate chains substantially increase the JSON response size. The response size also depends on the number of published keys, which may change during signing-key rotation.

In our deployment, retrieving the original JWKS response fails with the HTTP client's cannot increase buffer warning, preventing successful JWT validation.

Increasing Buffer_Chunk_Size or Buffer_Max_Size on the HTTP input does not resolve the problem: those settings control incoming requests, not the separate HTTP client used to download JWKS.

Relevant configuration

The following is a sanitized configuration excerpt. All identifiers are placeholders.

    [INPUT]
        Name                          http
        Listen                        0.0.0.0
        Port                          9880
        Tag                           remote.app
        Buffer_Chunk_Size             512KB
        Buffer_Max_Size               8MB

        Oauth2.validate               true
        Oauth2.issuer                 https://login.microsoftonline.com/<tenant-id>/v2.0
        Oauth2.jwks_url               https://login.microsoftonline.com/<tenant-id>/discovery/v2.0/keys
        Oauth2.allowed_clients        <application-client-id>
        Oauth2.jwks_refresh_interval  300

Observed behavior

The internal HTTP client reports: [http_client] cannot increase buffer.

The JWKS download fails when the response exceeds the client's capacity.

This is a fixed limit on the HTTP response used to retrieve public signing keys, not a limit on the incoming access token or application log payload.

Expected behavior

Fluent Bit should support JWKS responses larger than 4 KiB.

Ideally, the maximum JWKS HTTP response buffer size should be configurable, with a bounded default and clear documentation that the limit includes HTTP response headers and body.

Code investigation

In v5.1.5, oauth2_jwks_fetch_keys() creates an HTTP client and proceeds to flb_http_do() without setting a larger response buffer:

• JWKS fetch implementation
• Default HTTP client buffer limit: FLB_HTTP_DATA_SIZE_MAX = 4096

The HTTP client already provides flb_http_buffer_size(), but the JWKS fetch path does not use it to adjust the limit.

Suggested improvement

Please consider:

• Adding a JWKS-specific maximum response size setting, for example oauth2.jwks_buffer_max_size — proposed name, not an existing option.
• Applying the configured limit to the HTTP client created by oauth2_jwks_fetch_keys().
• Keeping allocations demand-driven and enforcing a finite maximum.
• Returning a clear diagnostic when the configured maximum is exceeded.
• Documenting that the limit covers headers and body.

A larger fixed default would help, but a configurable maximum would also accommodate providers with larger key sets or certificate chains.

Related issues and PR

• #12512 — oauth2: add support for authorization details and larger token responses
  Reports the same default 4 KiB limitation for OAuth2 token acquisition. This report concerns the separate JWKS download path used for incoming JWT validation.

• #12520 — oauth2: support authorization details and larger token responses
  At reviewed commit cfacc6db271cd8b693473426706368019526f54a, this PR increases the token-request client's limit to 64 KiB in src/flb_oauth2.c, but does not update oauth2_jwks_fetch_keys() in src/flb_oauth2_jwt.c.

• #9061 — Bigquery Output Plugin HTTP buffer size is not configurable
  Related request to expose the HTTP response buffer limit in another component.

• #7849 — HTTP client cannot increase buffer beyond 4096 bytes
  Related reports and discussion about exposing response buffer configuration.

• #4044 — 4096 bytes are not enough to process CloudWatch response
  Historical example of the same default limit requiring a component-specific fix.