The exp claim should always appear in the JWT

[federicaagostini]

According with RFC 9068, the exp claim of the JWT (indicating the expiration time) should appear in the token.

In IAM, when one sets the access token lifetime as infinite (value equal to 0) the exp claim does not appear in the AT.

We should not allow users to set an infinite lifetime of the token. Suggestion on the max lifetime one can set for an AT is commented here.

[federicaagostini]

Solved in MitreID, with commit 0c64dc6.

[giacomini]

Just for the record, the exp claim must appear in the token.