[JIRA] (JOIDC-117) Take clock skew into account in revocation lifetimes

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *resolved* as *Fixed*

This fix is very important for deployments that has enabled the use of JWT access tokens with revocation and has the revocation method set to "TOKEN". This method was introduced in 3.2.0. Before this week wiith this configuration, an expired revocation record may have been cleaned out by the storage cleanup process, even though the clock skew allows the expired JWT access token to still be accepted in introspection and userinfo endpoints.

Clock skew is not currently allowed for opaque tokens, so they're not similarly affected.

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiNmQ2MTFhYjBiZWU0NDRjMzgzNzVjNDdiZGIwYWUxZjUiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-117?atlOrigin=eyJpIjoiNmQ2MTFhYjBiZWU0NDRjMzgzNzVjNDdiZGIwYWUxZjUiLCJwIjoiaiJ9 ) JOIDC-117 ( https://shibboleth.atlassian.net/browse/JOIDC-117?atlOrigin=eyJpIjoiNmQ2MTFhYjBiZWU0NDRjMzgzNzVjNDdiZGIwYWUxZjUiLCJwIjoiaiJ9 ) Take clock skew into account in revocation lifetimes ( https://shibboleth.atlassian.net/browse/JOIDC-117?atlOrigin=eyJpIjoiNmQ2MTFhYjBiZWU0NDRjMzgzNzVjNDdiZGIwYWUxZjUiLCJwIjoiaiJ9 )

Change By: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Resolution: Fixed Status: In Progress Resolved

( https://shibboleth.atlassian.net/browse/JOIDC-117#add-comment?atlOrigin=eyJpIjoiNmQ2MTFhYjBiZWU0NDRjMzgzNzVjNDdiZGIwYWUxZjUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-117#add-comment?atlOrigin=eyJpIjoiNmQ2MTFhYjBiZWU0NDRjMzgzNzVjNDdiZGIwYWUxZjUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100201- sha1:8893fc8 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220707/6856420b/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-8cdd60ba-207c-4b8f-ac20-f71620a911f1
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220707/6856420b/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-055ee240-5652-471f-9f60-bad5e4f2b20f
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220707/6856420b/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-498b2385-0075-48ac-87f9-8c5ba6399e40
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220707/6856420b/attachment-0005.png>