[JIRA] (JOIDC-82) Dyn.reg. profile config setting secretExpirationPeriod is not honored

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiNzUyZjg5NjIyYjg3NGY1ODg3ZmE2YTA0ZjA0ZjFmYTciLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-82?atlOrigin=eyJpIjoiNzUyZjg5NjIyYjg3NGY1ODg3ZmE2YTA0ZjA0ZjFmYTciLCJwIjoiaiJ9 ) JOIDC-82 ( https://shibboleth.atlassian.net/browse/JOIDC-82?atlOrigin=eyJpIjoiNzUyZjg5NjIyYjg3NGY1ODg3ZmE2YTA0ZjA0ZjFmYTciLCJwIjoiaiJ9 ) Dyn.reg. profile config setting secretExpirationPeriod is not honored ( https://shibboleth.atlassian.net/browse/JOIDC-82?atlOrigin=eyJpIjoiNzUyZjg5NjIyYjg3NGY1ODg3ZmE2YTA0ZjA0ZjFmYTciLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Created: 17/Mar/22 7:00 AM Priority: Trivial Reporter: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd )

As documented in https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879077/OPDynamicClientRegistration#Profile-Settings , the profile configuration for dynamic client registration has a configurable expiration period for client secret. Currently it only sets the client_secret_expires_at (see 3.2 in [1]), which is stored in the OP server-side storage after successful registration and included in the registration response message for RP. However, that claim is not wired elsewhere, thus the client secrets are not really expiring even though the response message and stored metadata may claim otherwise.

If we enforce the expiration time for the client secrets, we probably should also implement a flag to allow expired client secrets (should possibly be true by default), as the current deployments most probably have dynamically registered RPs with expired secrets.

The related property *idp.oidc.dynreg.defaultSecretExpiration* has a default value of 12 months.

[1] https://openid.net/specs/openid-connect-registration-1_0.html

( https://shibboleth.atlassian.net/browse/JOIDC-82#add-comment?atlOrigin=eyJpIjoiNzUyZjg5NjIyYjg3NGY1ODg3ZmE2YTA0ZjA0ZjFmYTciLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-82#add-comment?atlOrigin=eyJpIjoiNzUyZjg5NjIyYjg3NGY1ODg3ZmE2YTA0ZjA0ZjFmYTciLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:676e6d5 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220317/5c49833d/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-4e888e84-86a2-4d30-ab94-bd45cab36d75
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220317/5c49833d/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-8c0de853-d71f-4518-93fb-3fed336f58e2
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220317/5c49833d/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-d9a73929-5c98-4525-b30b-8b7f6bb267bb
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220317/5c49833d/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-82dfa1eb-7cbc-4d5c-81a4-3c15052a5e72
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220317/5c49833d/attachment-0007.png>