Symptoms

In BIG-IP APM OIDC Discovery, when two or more OAuth/OIDC providers are configured under a single JWT Provider List and attached to an OAuth Scope agent which is attached to a per request policy, the OIDC Discovery worker (OIDCDiscoverTaskCollectionWorker) intermittently logs: Updating mcp jwt and jwk objects for provider <provider> for all providers in the list, even when: Only one provider’s JWKS Key-ID (kid) set changed, or No provider’s JWKS Key-ID set changed This behavior occurs outside of the expected first discovery cycle after restjavad restart. The issue is visible in /var/log/restjavad* and results in unnecessary MCP write operations for providers whose JWKS content did not change.

Impact

-- Unnecessary MCP updates for JWT and JWK objects -- Configuration churn within MCP even when no material key change occurs -- Increased internal processing and logging noise

Conditions

-- BIG-IP APM with OIDC Discovery enabled -- Multiple OAuth/OIDC providers configured in a single JWT Provider List -- Provider List attached to an OAuth Scope agent (API Protection / per-request policy) -- Discovery interval configured (e.g., 5 minutes) -- Providers’ discovery tasks run in close time proximity (same scheduling window) -- One of the following scenarios: - Only one provider rotates keys - No providers rotate keys - After initial discovery stabilization (not first run after restjavad restart) The providers do not need to be started at precisely the same second; tasks starting within a short time window (seconds) are sufficient to trigger the issue.

Workaround

None

Fix Information

None

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips