Module cron: what is it for and how frequently should it run?

Hi,

I'd say that twice or even once a day is fine.

The cronjob is indeed used to update the stored JSON web keys (which are used to verify the incoming OpenID Connect request).
But the validation code also contains a fallback, when an unknown key ID is specified it automatically updates they key set to make sure it ain't a new key.

The main reason to keep the cron is to also remove any revoked keys, so it's up to you to decide what "risk" (accepting a revoked key) you are willing to take.

Hope this helps a bit?

Thanks for the fast response!

One follow-up question though: What would a 'revoked key' imply for this case. A person that lost its citizenship?

These are server keys, not user keys. If somehow the private key of an OpenID server leaks they can revoke it, otherwise a malicious provider would be able to sign the authentication data with the leaked key and thus forge sign-ins.

Ah, clear. Thanks!