[GitHub] [cxf] amarkevich opened a new pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

[GitHub] [cxf] amarkevich opened a new pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued

GitBox
amarkevich opened a new pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued
URL: https://github.com/apache/cxf/pull/645
 
 
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
[hidden email]


With regards,
Apache Git Services
Reply | Threaded
Open this post in threaded view
|

[GitHub] [cxf] coheigea commented on a change in pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued

GitBox
coheigea commented on a change in pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued
URL: https://github.com/apache/cxf/pull/645#discussion_r386372736
 
 

 ##########
 File path: rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
 ##########
 @@ -78,7 +78,12 @@ private String getProcessedIdToken(ServerAccessToken st) {
                 idToken.setAudience(st.getClient().getClientId());
                 idToken.setAuthorizedParty(st.getClient().getClientId());
                 // if this token was refreshed then the cloned IDToken might need to have its
-                // issuedAt and expiry time properties adjusted if it proves to be necessary
+                // issuedAt and expiry time properties adjusted
+                if (null == st.getResponseType()) {
+                    final Long iat = st.getIssuedAt();
+                    idToken.setExpiryTime(iat + (idToken.getExpiryTime() - idToken.getIssuedAt()));
+                    idToken.setIssuedAt(iat);
+                }
 
 Review comment:
   Could you explain the logic here? Why set issued at / expiry only if st.getResponseType() is null?

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
[hidden email]


With regards,
Apache Git Services
Reply | Threaded
Open this post in threaded view
|

[GitHub] [cxf] amarkevich commented on a change in pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued

GitBox
In reply to this post by GitBox
amarkevich commented on a change in pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued
URL: https://github.com/apache/cxf/pull/645#discussion_r386376623
 
 

 ##########
 File path: rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
 ##########
 @@ -78,7 +78,12 @@ private String getProcessedIdToken(ServerAccessToken st) {
                 idToken.setAudience(st.getClient().getClientId());
                 idToken.setAuthorizedParty(st.getClient().getClientId());
                 // if this token was refreshed then the cloned IDToken might need to have its
-                // issuedAt and expiry time properties adjusted if it proves to be necessary
+                // issuedAt and expiry time properties adjusted
+                if (null == st.getResponseType()) {
+                    final Long iat = st.getIssuedAt();
+                    idToken.setExpiryTime(iat + (idToken.getExpiryTime() - idToken.getIssuedAt()));
+                    idToken.setIssuedAt(iat);
+                }
 
 Review comment:
   `st.getResponseType() == null` in case of request with param `grant_type=refresh_token`

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
[hidden email]


With regards,
Apache Git Services
Reply | Threaded
Open this post in threaded view
|

[GitHub] [cxf] coheigea commented on a change in pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued

GitBox
In reply to this post by GitBox
coheigea commented on a change in pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued
URL: https://github.com/apache/cxf/pull/645#discussion_r387175835
 
 

 ##########
 File path: rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
 ##########
 @@ -78,7 +78,12 @@ private String getProcessedIdToken(ServerAccessToken st) {
                 idToken.setAudience(st.getClient().getClientId());
                 idToken.setAuthorizedParty(st.getClient().getClientId());
                 // if this token was refreshed then the cloned IDToken might need to have its
-                // issuedAt and expiry time properties adjusted if it proves to be necessary
+                // issuedAt and expiry time properties adjusted
+                if (null == st.getResponseType()) {
+                    final Long iat = st.getIssuedAt();
+                    idToken.setExpiryTime(iat + (idToken.getExpiryTime() - idToken.getIssuedAt()));
+                    idToken.setIssuedAt(iat);
+                }
 
 Review comment:
   Is there a way instead we can tell that grant_type=refresh_token was used in the call?

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
[hidden email]


With regards,
Apache Git Services
Reply | Threaded
Open this post in threaded view
|

[GitHub] [cxf] amarkevich merged pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued

GitBox
In reply to this post by GitBox
amarkevich merged pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued
URL: https://github.com/apache/cxf/pull/645
 
 
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
[hidden email]


With regards,
Apache Git Services