Skip to content

Commit

Permalink
Set exp claim also for 0 AT lifetimes
Browse files Browse the repository at this point in the history
  • Loading branch information
@federicaagostini
federicaagostini committed Sep 7, 2023
1 parent 521019f commit 0c64dc6
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions ...server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ProviderTokenService.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -220,10 +220,10 @@ public OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentica
token.setScope(scopeService.toStrings(scopes));

// make it expire if necessary
if (client.getAccessTokenValiditySeconds() != null
&& client.getAccessTokenValiditySeconds() > 0) {
if (client.getAccessTokenValiditySeconds() != null ) {

This comment has been minimized.

Sign in to view

Copy link
@giacomini

giacomini Sep 9, 2023

What happens if it is null? What happens if it's negative?

This comment has been minimized.

Sign in to view

Copy link
@federicaagostini

federicaagostini Sep 11, 2023

Author

If it's negative or zero the token lifetime is set equal to zero in IAM and the exp claim appears in the AT.

This comment has been minimized.

Sign in to view

Copy link
@federicaagostini

federicaagostini Sep 11, 2023

Author

In case it is null, we set it equal to the default configuration value (with commit 9f9c2bf), that is 3600 now and can be changed by IAM operators. For clients registered trough API before this commit, if the AT lifetime is null it will result in an AT without exp claim. Do we want to fix this use case in MitreID?
Date expiration =
new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L));

token.setExpiration(expiration);
}

Expand Down

0 comments on commit 0c64dc6

Please sign in to comment.