[java-oidc-common] branch main updated: JCOMOIDC-58 - Convert authnLifetime to internal strategy
Phil Smart
philip.smart at jisc.ac.uk
Mon Dec 19 14:16:17 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=7e19706f21ad00e07355c28bd6a59157036efca1
The following commit(s) were added to refs/heads/main by this push:
new 7e19706 JCOMOIDC-58 - Convert authnLifetime to internal strategy
7e19706 is described below
commit 7e19706f21ad00e07355c28bd6a59157036efca1
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Dec 19 14:16:13 2022 +0000
JCOMOIDC-58 - Convert authnLifetime to internal strategy
https://shibboleth.atlassian.net/browse/JCOMOIDC-58
---
.../impl/AuthenticationTimeClaimsValidator.java | 28 ++++++++++++++---
.../AuthenticationTimeClaimsValidatorTest.java | 36 +++++++++++++++++-----
2 files changed, 51 insertions(+), 13 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidator.java
index 4bb9fde..af5cd92 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidator.java
@@ -22,6 +22,7 @@ import java.text.ParseException;
import java.time.Duration;
import java.time.Instant;
import java.util.Date;
+import java.util.function.Function;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
@@ -38,6 +39,7 @@ import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.utilities.java.support.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
* Verifies the auth_time (when the End-User authentication took place) is within a valid expiration window.
@@ -51,10 +53,10 @@ public class AuthenticationTimeClaimsValidator extends AbstractClaimsValidator {
@Nonnull private final Logger log = LoggerFactory.getLogger(AuthenticationTimeClaimsValidator.class);
/**
- * If requested, the amount of time for which a token is valid
+ * Lookup strategy to find the amount of time for which a token is valid
* after if it was first issued. (Default value: 60 seconds)
*/
- @Nonnull private Duration authnLifetime;
+ @Nonnull private Function<ProfileRequestContext, Duration> authnLifetimeLookupStrategy;
/**
* Positive clock skew adjustment to consider when checking auth_time is not in the future
@@ -70,7 +72,7 @@ public class AuthenticationTimeClaimsValidator extends AbstractClaimsValidator {
/** Constructor.*/
public AuthenticationTimeClaimsValidator() {
- authnLifetime = Duration.ofSeconds(60);
+ authnLifetimeLookupStrategy = prc -> Duration.ofSeconds(60);
clockSkew = Duration.ofSeconds(60);
requested = Predicates.alwaysTrue();
}
@@ -111,7 +113,23 @@ public class AuthenticationTimeClaimsValidator extends AbstractClaimsValidator {
Constraint.isNotNull(lifetime, "Token authentication lifetime cannot be null");
Constraint.isFalse(lifetime.isNegative(), "Token authentication lifetime cannot be negative");
- authnLifetime = lifetime;
+ authnLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
+ }
+
+ /**
+ * Set the lookup strategy used to locate the amount of time for which a token is valid from when the original
+ * authentication took place.
+ *
+ * @param strategy the strategy
+ *
+ * @since 2.2.0
+ */
+ public void setAuthnLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext, Duration> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ authnLifetimeLookupStrategy = Constraint.isNotNull(strategy,
+ "AuthnLifetime Lookup Strategy can not be null");
}
@Override
@@ -131,7 +149,7 @@ public class AuthenticationTimeClaimsValidator extends AbstractClaimsValidator {
final Instant authTime = authTimeDate.toInstant();
final Instant now = Instant.now();
final Instant latestValid = now.plus(clockSkew);
- final Instant expiration = authTime.plus(clockSkew).plus(authnLifetime);
+ final Instant expiration = authTime.plus(clockSkew).plus(authnLifetimeLookupStrategy.apply(context));
// Check time of authentication wasn't in the future
if (authTime.isAfter(latestValid)) {
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidatorTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidatorTest.java
index e93f38e..fa9ed04 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidatorTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidatorTest.java
@@ -22,7 +22,6 @@ import java.time.Instant;
import javax.annotation.Nonnull;
-
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -38,6 +37,7 @@ public class AuthenticationTimeClaimsValidatorTest extends AbstractClaimsValidat
@Nonnull private AuthenticationTimeClaimsValidator validator;
+ @Override
@BeforeMethod
public void setup() throws ComponentInitializationException {
super.setup();
@@ -52,9 +52,29 @@ public class AuthenticationTimeClaimsValidatorTest extends AbstractClaimsValidat
validator.setAuthnLifetime(Duration.ofMinutes(1));
validator.setClockSkew(Duration.ofSeconds(0));
validator.initialize();
- validator.validate(claimsSet, prc); }
+ validator.validate(claimsSet, prc);
+ }
-
+ @Test
+ public void doValidateTest_UseAuthnStrategy() throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().claim(
+ IDTokenClaims.AUTHENTICATION_TIME.getClaimName(), Instant.now().getEpochSecond()).build();
+ validator.setId("test-validator");
+ validator.setAuthnLifetimeLookupStrategy(prc -> Duration.ofMinutes(1));
+ validator.setClockSkew(Duration.ofSeconds(0));
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
+ @Test
+ public void doValidateTest_DefaultAuthnTime() throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().claim(
+ IDTokenClaims.AUTHENTICATION_TIME.getClaimName(), Instant.now().getEpochSecond()).build();
+ validator.setId("test-validator");
+ validator.setClockSkew(Duration.ofSeconds(0));
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
@Test
public void doValidateTestWithinLifetime() throws JWTValidationException, ComponentInitializationException {
@@ -79,7 +99,7 @@ public class AuthenticationTimeClaimsValidatorTest extends AbstractClaimsValidat
}
@Test(expectedExceptions = JWTValidationException.class)
- public void doInValidateTestCanNotParseDate() throws JWTValidationException, ComponentInitializationException {
+ public void doRejectedTestCanNotParseDate() throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().claim(
IDTokenClaims.AUTHENTICATION_TIME.getClaimName(),"not-a-date").build();
validator.setId("test-validator");
@@ -89,7 +109,7 @@ public class AuthenticationTimeClaimsValidatorTest extends AbstractClaimsValidat
}
@Test(expectedExceptions = JWTValidationException.class)
- public void doInValidateTest() throws JWTValidationException, ComponentInitializationException {
+ public void doRejectedTest() throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().claim(
IDTokenClaims.AUTHENTICATION_TIME.getClaimName(),
Instant.now().minus(Duration.ofMinutes(10)).getEpochSecond()).build();
@@ -101,7 +121,7 @@ public class AuthenticationTimeClaimsValidatorTest extends AbstractClaimsValidat
}
@Test(expectedExceptions = JWTValidationException.class)
- public void doInValidateInTheFuture() throws JWTValidationException, ComponentInitializationException {
+ public void doRejectedInTheFuture() throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().claim(
IDTokenClaims.AUTHENTICATION_TIME.getClaimName(),
Instant.now().plus(Duration.ofSeconds(30)).getEpochSecond()).build();
@@ -114,7 +134,7 @@ public class AuthenticationTimeClaimsValidatorTest extends AbstractClaimsValidat
}
@Test
- public void doInValidateInTheFutureButInsideSkew() throws JWTValidationException, ComponentInitializationException {
+ public void doRejectedInTheFutureButInsideSkew() throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().claim(
IDTokenClaims.AUTHENTICATION_TIME.getClaimName(),
Instant.now().plus(Duration.ofSeconds(30)).getEpochSecond()).build();
@@ -127,7 +147,7 @@ public class AuthenticationTimeClaimsValidatorTest extends AbstractClaimsValidat
}
@Test(expectedExceptions = JWTValidationException.class)
- public void doInValidateNoClaim() throws JWTValidationException, ComponentInitializationException {
+ public void doRejectedNoClaim() throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().build();
validator.setId("test-validator");
validator.setAuthnLifetime(Duration.ofMinutes(1));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list