[java-oidc-common] branch main updated: JOIDC-152 - Implement maximum refresh time and/or maximum refresh uses.
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Apr 28 15:10:07 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=ab2bfab1a3349f21500ddbac9126332a6ecf2895
The following commit(s) were added to refs/heads/main by this push:
new ab2bfab JOIDC-152 - Implement maximum refresh time and/or maximum refresh uses.
ab2bfab is described below
commit ab2bfab1a3349f21500ddbac9126332a6ecf2895
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Apr 28 18:09:58 2023 +0300
JOIDC-152 - Implement maximum refresh time and/or maximum refresh uses.
https://shibboleth.atlassian.net/browse/JOIDC-152
Deprecate refreshTokenLifetime profile conf parameter
Add refreshTokenTimeout and refreshTokenChainLifetime
---
...> RefreshTokenChainLifetimeLookupFunction.java} | 8 +-
.../RefreshTokenLifetimeLookupFunction.java | 3 +
...java => RefreshTokenTimeoutLookupFunction.java} | 8 +-
...2RefreshTokenProducingProfileConfiguration.java | 30 ++++++++
.../config/impl/AbstractOIDCSSOConfiguration.java | 89 +++++++++++++++++++++-
5 files changed, 131 insertions(+), 7 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenChainLifetimeLookupFunction.java
similarity index 90%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenChainLifetimeLookupFunction.java
index 64ab92c..9494f42 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenChainLifetimeLookupFunction.java
@@ -30,13 +30,15 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProf
/**
* A function that returns
- * {@link OAuth2RefreshTokenProducingProfileConfiguration#getRefreshTokenLifetime(ProfileRequestContext)}
+ * {@link OAuth2RefreshTokenProducingProfileConfiguration#getRefreshTokenChainLifetime(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
* <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 2.2.0
*/
-public class RefreshTokenLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
+public class RefreshTokenChainLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
@Override
@@ -45,7 +47,7 @@ public class RefreshTokenLifetimeLookupFunction extends AbstractRelyingPartyLook
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc instanceof OAuth2RefreshTokenProducingProfileConfiguration) {
- return ((OAuth2RefreshTokenProducingProfileConfiguration) pc).getRefreshTokenLifetime(input);
+ return ((OAuth2RefreshTokenProducingProfileConfiguration) pc).getRefreshTokenChainLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
index 64ab92c..845148e 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
@@ -35,7 +35,10 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProf
* by default a child of the {@link ProfileRequestContext}.
*
* <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @deprecated use {@link RefreshTokenTimeoutLookupFunction}
*/
+ at Deprecated(since = "2.2.0", forRemoval=true)
public class RefreshTokenLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenTimeoutLookupFunction.java
similarity index 91%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenTimeoutLookupFunction.java
index 64ab92c..17b9575 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenTimeoutLookupFunction.java
@@ -30,13 +30,15 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProf
/**
* A function that returns
- * {@link OAuth2RefreshTokenProducingProfileConfiguration#getRefreshTokenLifetime(ProfileRequestContext)}
+ * {@link OAuth2RefreshTokenProducingProfileConfiguration#getRefreshTokenTimeout(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
* <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 2.2.0
*/
-public class RefreshTokenLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
+public class RefreshTokenTimeoutLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
@Override
@@ -45,7 +47,7 @@ public class RefreshTokenLifetimeLookupFunction extends AbstractRelyingPartyLook
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc instanceof OAuth2RefreshTokenProducingProfileConfiguration) {
- return ((OAuth2RefreshTokenProducingProfileConfiguration) pc).getRefreshTokenLifetime(input);
+ return ((OAuth2RefreshTokenProducingProfileConfiguration) pc).getRefreshTokenTimeout(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
index bc3714f..bed39ef 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
@@ -39,9 +39,39 @@ public interface OAuth2RefreshTokenProducingProfileConfiguration extends OAuth2P
* @param profileRequestContext profile request context
*
* @return refresh token lifetime
+ *
+ * @deprecated Use {@link #getRefreshTokenTimeout(ProfileRequestContext)}
*/
+ @Deprecated(since = "2.2.0", forRemoval=true)
@Nonnull @Positive Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get refresh token timeout. The expiration of a single refresh token is calculated based on this value.
+ *
+ * <p>Defaults to 2 hours.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return refresh token timeout
+ *
+ * @since 2.2.0
+ */
+ @Nonnull @Positive Duration getRefreshTokenTimeout(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get refresh token chain lifetime. The expiration of a single refresh token is calculated based on this value.
+ *
+ * <p>Defaults to 2 hours.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return refresh token timeout
+ *
+ * @since 2.2.0
+ */
+ @Nonnull @Positive Duration getRefreshTokenChainLifetime(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
//TODO: can move the getRefreshTokenClaimsSetManipulationStrategy from the OAuth2TokenProfileConfiguration in 3.0.0
// to keep consistent with other token producers
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 8c7dfd0..03a03cf 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -76,7 +76,13 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** Lookup function to supply refresh token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
-
+
+ /** Lookup function to supply refresh token timeout. */
+ @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenTimeoutLookupStrategy;
+
+ /** Lookup function to supply refresh token chain lifetime. */
+ @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenChainLifetimeLookupStrategy;
+
/** Lookup function to supply additional audiences for ID token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
@@ -111,6 +117,8 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
+ refreshTokenTimeoutLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
+ refreshTokenChainLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
@@ -330,6 +338,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
@Override
@Nonnull @Positive
+ @Deprecated(since = "2.2.0", forRemoval=true)
public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
@@ -342,7 +351,10 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
* Set the lifetime of refresh token.
*
* @param lifetime lifetime of an refresh token
+ *
+ * @deprecated Use {@link #setRefreshTokenTimeout(Duration)}
*/
+ @Deprecated(since = "2.2.0", forRemoval=true)
public void setRefreshTokenLifetime(@Nonnull @Positive final Duration lifetime) {
Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
"Refresh token lifetime must be greater than 0");
@@ -354,12 +366,87 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
* Set a lookup strategy for the refresh token lifetime.
*
* @param strategy lookup strategy
+ *
+ * @deprecated Use {@link #setRefreshTokenTimeoutLookupStrategy(Function)}
*/
+ @Deprecated(since = "2.2.0", forRemoval=true)
public void setRefreshTokenLifetimeLookupStrategy(
@Nullable final Function<ProfileRequestContext,Duration> strategy) {
refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ @Override
+ @Nonnull @Positive
+ public Duration getRefreshTokenTimeout(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Duration timeout = refreshTokenTimeoutLookupStrategy.apply(profileRequestContext);
+
+ Constraint.isTrue(timeout != null && !timeout.isZero() && !timeout.isNegative(),
+ "Refresh token timeout must be greater than 0");
+ return timeout;
+ }
+
+ /**
+ * Set the timeout of refresh token.
+ *
+ * @param timeout timeout of an refresh token
+ *
+ * @since 2.2.0
+ */
+ public void setRefreshTokenTimeout(@Nonnull @Positive final Duration timeout) {
+ Constraint.isTrue(timeout != null && !timeout.isZero() && !timeout.isNegative(),
+ "Refresh token timeout must be greater than 0");
+
+ refreshTokenTimeoutLookupStrategy = FunctionSupport.constant(timeout);
+ }
+
+ /**
+ * Set a lookup strategy for the refresh token timeout.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 2.2.0
+ */
+ public void setRefreshTokenTimeoutLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,Duration> strategy) {
+ refreshTokenTimeoutLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ @Override
+ @Nonnull @Positive
+ public Duration getRefreshTokenChainLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Duration lifetime = refreshTokenChainLifetimeLookupStrategy.apply(profileRequestContext);
+
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Refresh token chain lifetime must be greater than 0");
+ return lifetime;
+ }
+
+ /**
+ * Set the lifetime of refresh token chain.
+ *
+ * @param lifetime lifetime of a refresh token chain
+ *
+ * @since 2.2.0
+ */
+ public void setRefreshTokenChainLifetime(@Nonnull @Positive final Duration lifetime) {
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Refresh token chain lifetime must be greater than 0");
+
+ refreshTokenChainLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
+ }
+
+ /**
+ * Set a lookup strategy for the refresh token chain lifetime.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 2.2.0
+ */
+ public void setRefreshTokenChainLifetimeLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,Duration> strategy) {
+ refreshTokenChainLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
@Override
@Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(
@Nullable final ProfileRequestContext profileRequestContext) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list