we are building a webapi for external clients. we want the clients to authenticate using their corp accounts. since each firm will have their own IdPs, we are looking at a system where the JWTs can have different iss and aud

so far all the spring examples on oidc/oauth2.0 assumes one IdP. we want to build a dynamic system where we can add a new firm/IdP at runtime, without restart.

we’ll not have more than 100 such firms/IdPs.

i am thinking of registering a OncePerRequestFilter to validate the JWT.

• we’ll have database of URLs to clients open id connect documents
• we’ll get the signing keys from the open id connect documents
• in the filter we’ll try all the signing keys one by one until we get key that works
• assuming 5-10 keys per firm, and not more than 100 open id connect documents we are ok with this linear search
• we’ll use aud and iss to uniquely identify a firm
• we’ll use a list of claims provided by each firm to uniquely identify a user in that firm. like subj and/or oid or any custom claims depending on the IdPs settings

is this the correct approach?