[JIRA] (JOIDCRP-36) Add RP specific clockSkew property for IssuedAtClaimsValidator

[Philip Smart (Jira)]

Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 ) *created* an issue

IdP Plugin - OIDC RP ( https://shibboleth.atlassian.net/browse/JOIDCRP?atlOrigin=eyJpIjoiNjQ2MmQ5OGRiMDk2NDY2ZTk4MjJjMWVmOTA0YjAwNmIiLCJwIjoiaiJ9 ) / New Feature ( https://shibboleth.atlassian.net/browse/JOIDCRP-36?atlOrigin=eyJpIjoiNjQ2MmQ5OGRiMDk2NDY2ZTk4MjJjMWVmOTA0YjAwNmIiLCJwIjoiaiJ9 ) JOIDCRP-36 ( https://shibboleth.atlassian.net/browse/JOIDCRP-36?atlOrigin=eyJpIjoiNjQ2MmQ5OGRiMDk2NDY2ZTk4MjJjMWVmOTA0YjAwNmIiLCJwIjoiaiJ9 ) Add RP specific clockSkew property for IssuedAtClaimsValidator ( https://shibboleth.atlassian.net/browse/JOIDCRP-36?atlOrigin=eyJpIjoiNjQ2MmQ5OGRiMDk2NDY2ZTk4MjJjMWVmOTA0YjAwNmIiLCJwIjoiaiJ9 )

Issue Type: New Feature Affects Versions: 1.0.0 Assignee: Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 ) Components: oidc-rp-impl Created: 05/Jun/23 7:01 AM Fix Versions: 1.0.1 Priority: Trivial Reporter: Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 )

Azure AD sets the Issued At (iat) claim 5 minutes before the time at which the JWT was actually issued (to deal with clock synch issues). For the RP to accept the ‘iat’ claim, the IssuedAtClaimsValidator needs to be configured with a suitable clockSkew e.g. 6 minutes.

This is currently configured from the IdP wide idp.policy.clockSkew property. A deployer may not want to set this more general clockSkew property for the whole IdP, and may want a way to override that with an RP-specific property (defaulting to the idp version if not set, further defaulting to a bean default if neither are set).

( https://shibboleth.atlassian.net/browse/JOIDCRP-36#add-comment?atlOrigin=eyJpIjoiNjQ2MmQ5OGRiMDk2NDY2ZTk4MjJjMWVmOTA0YjAwNmIiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDCRP-36#add-comment?atlOrigin=eyJpIjoiNjQ2MmQ5OGRiMDk2NDY2ZTk4MjJjMWVmOTA0YjAwNmIiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:4a1ccf9 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230605/436dcf10/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-f1dbc331-f284-4f49-a1bd-79fac1adedc8
Type: image/png
Size: 302 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230605/436dcf10/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-eacf8fbd-12bd-4497-af77-68d657eeca8f
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230605/436dcf10/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-edf682fe-eb50-49b3-8be3-68d831e0fdcd
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230605/436dcf10/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-858fc701-9bcb-4b9f-81e2-1299531dd9d2
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230605/436dcf10/attachment-0007.png>