[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-36 - Add RP specific clockSkew property for IssuedAtClaimsValidator

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=be34d3fee2e1a2c8cad09296a5cf95eb9a4fbbf7

The following commit(s) were added to refs/heads/main by this push:
     new be34d3f  JOIDCRP-36 - Add RP specific clockSkew property for IssuedAtClaimsValidator
be34d3f is described below

commit be34d3fee2e1a2c8cad09296a5cf95eb9a4fbbf7
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jun 5 16:41:39 2023 +0100

    JOIDCRP-36 - Add RP specific clockSkew property for
    IssuedAtClaimsValidator
    
     - added override property
    idp.authn.oidc.rp.client.jwt.verifier.clockSkew
    
    https://shibboleth.atlassian.net/browse/JOIDCRP-36
---
 .../authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml      | 7 ++++---
 .../idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties         | 4 +++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index d0552c3..e0d3b69 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -510,14 +510,15 @@
     </util:set>
 
     <bean id="ExpiryClaimsValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
-        p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
+        p:clockSkew="#{environment.containsProperty('idp.authn.oidc.rp.client.jwt.verifier.clockSkew') ? environment.getProperty('idp.authn.oidc.rp.client.jwt.verifier.clockSkew') : '%{idp.policy.clockSkew:PT1M}'}" />
 
     <bean id="NotBeforeClaimsValidator"
         class="net.shibboleth.oidc.security.jwt.claims.impl.NotBeforeClaimsValidator"
-        p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
+        p:clockSkew="#{environment.containsProperty('idp.authn.oidc.rp.client.jwt.verifier.clockSkew') ? environment.getProperty('idp.authn.oidc.rp.client.jwt.verifier.clockSkew') : '%{idp.policy.clockSkew:PT1M}'}" />
 
     <bean id="IssuedAtClaimsValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator"
-        p:clockSkew="%{idp.policy.clockSkew:PT1M}" p:messageLifetime="%{idp.policy.messageLifetime:PT1M}"
+        p:clockSkew="#{environment.containsProperty('idp.authn.oidc.rp.client.jwt.verifier.clockSkew') ? environment.getProperty('idp.authn.oidc.rp.client.jwt.verifier.clockSkew') : '%{idp.policy.clockSkew:PT1M}'}" 
+        p:messageLifetime="%{idp.policy.messageLifetime:PT1M}"
         p:requiredRule="false" />
 
     <bean id="IssuerClaimsValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
index 9af3540..82502c6 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
@@ -24,9 +24,11 @@ idp.authn.oidc.rp.client.redirecturl.allowedOrigins = https://localhost:8443
 #    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
 #    saml1/urn:oasis:names:tc:SAML:1.0:am:password
 
-## JWT verification properties
+## IDToken JWT verification properties
 #idp.authn.oidc.rp.client.idtoken.jwt.verifier.clockSkew = PT60S
 #idp.authn.oidc.rp.client.idtoken.jwt.verifier.authnLifetime = PT60S
+## General JWT verification properties
+#idp.authn.oidc.rp.client.jwt.verifier.clockSkew = PT1M
 
 ## Should validation be skipped if the at_hash is not present in the id_token response. Defaults to 'true' as 
 ## access token at_hash validation is optional in the Authorization Code Flow. 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.