[JIRA] (JOIDC-152) Implement maximum refresh time and/or maximum refresh uses.

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *commented* on JOIDC-152 ( https://shibboleth.atlassian.net/browse/JOIDC-152?atlOrigin=eyJpIjoiYTYwN2IwNTA3OTgxNDBmMDhkNjIyYzAzMTNhYTBkYjEiLCJwIjoiaiJ9 )

Re: Implement maximum refresh time and/or maximum refresh uses. ( https://shibboleth.atlassian.net/browse/JOIDC-152?atlOrigin=eyJpIjoiYTYwN2IwNTA3OTgxNDBmMDhkNjIyYzAzMTNhYTBkYjEiLCJwIjoiaiJ9 )

After some more internal discussions, we ended up deprecating the current refreshTokenLifetime profile configuration option. The two new options replaces it:

* refreshTokenChainLifetime : How long the refresh token chain is valid after the initial flow involving end-user authentication. Default is 2 hours, global property idp.oidc.refreshToken.defaultChainLifetime
* refreshTokenTimeout : How long a single refresh token is valid. Default is 2 hours, global property idp.oidc.refreshToken.defaultTimeout

In addition to the token endpoint (grant validation and token issuance), these values are also exploited in the introspection and revocation flows.

The chain expiration ( c_exp ) claim will be stored inside the refresh token claims sets from now on. For the tokens issued by earlier OP versions (and thus missing the claim), the value is added according to the current value of refreshTokenChainLifetime in the profile configuration: the chain expiration instant is calculated by “initial end-user authentication instant + refresh token chain lifetime”.

( https://shibboleth.atlassian.net/browse/JOIDC-152#add-comment?atlOrigin=eyJpIjoiYTYwN2IwNTA3OTgxNDBmMDhkNjIyYzAzMTNhYTBkYjEiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-152#add-comment?atlOrigin=eyJpIjoiYTYwN2IwNTA3OTgxNDBmMDhkNjIyYzAzMTNhYTBkYjEiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100223- sha1:3b773b8 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230428/e04d0e97/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-ddaaa154-3374-4354-a964-44d15ae3689e
Type: image/png
Size: 302 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230428/e04d0e97/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-9b44172b-ce12-4b04-9d86-a0da48cd0411
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230428/e04d0e97/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-d8f20267-ede8-4bc6-a583-bd61c1a58297
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230428/e04d0e97/attachment-0005.png>