JWT: add optional SignatureVerifier callback to Validator

[suraj-simha]

Adds an optional SignatureVerifier callback to the JWT Validator to support custom signature verification logic. When provided, the callback is called instead of the default sequential KeySet verification.

Motivation:
Vault's JWT auth plugin uses CAP for JWT validation, which delegates signature verification to go-oidc . The current flow checks each keyset's cache and if the key is not found, fetches from the JWKS URL before moving to the next keyset. This sequential fetch-per-keyset behavior was causing a performance issue for a customer with multiple JWKS endpoints configured.

This change adds a SignatureVerifier callback to CAP's Validator, allowing the plugin to own the signature verification logic and implement the desired behavior of checking all cache's before refreshing any key from the remote JWKs URLs.

The NewValidatorWithSignatureVerifier has been added to avoid modifying the existing NewValidator signature. Existing callers using NewValidator are completely unaffected.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[Copilot]

Pull request overview

This PR adds an optional SignatureVerifier callback to the JWT Validator so callers can provide custom signature verification logic (e.g., to avoid sequential per-JWKS fetch behavior), while keeping existing NewValidator callers unchanged.

Changes:

• Introduces SignatureVerifier and wires it into Validator.validateAll to bypass KeySet iteration when provided.
• Adds NewValidatorWithSignatureVerifier constructor with nil-checking.
• Adds unit tests for the new constructor.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
jwt/jwt.go	Adds SignatureVerifier, new constructor, and new validation path that uses the verifier instead of KeySets.
jwt/jwt_test.go	Adds tests covering NewValidatorWithSignatureVerifier constructor behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.