[java-oidc-common] branch main updated: JOIDC-152 - Implement maximum refresh time and/or maximum refresh uses.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=c1c542d09a215b70f3bf409863dbc4c951486ade

The following commit(s) were added to refs/heads/main by this push:
     new c1c542d  JOIDC-152 - Implement maximum refresh time and/or maximum refresh uses.
c1c542d is described below

commit c1c542d09a215b70f3bf409863dbc4c951486ade
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed May 3 12:24:50 2023 +0300

    JOIDC-152 - Implement maximum refresh time and/or maximum refresh uses.
    
    https://shibboleth.atlassian.net/browse/JOIDC-152
    
    - Modified setRefreshTokenLifetime to log deprecation warning.
    - Modified getRefreshTokenTimeout(PRC) to exploit refreshTokenLifetimeLookupStrategy if it returns non-default value
      - In that case we may expect that the default function has been modified either via relying-party.xml or SAML metadata entity attributes
      - Deprecation warning is logged
      - If old (lifetimeLookup) returns default 2 hours, then method returns the value from new (timeoutLookup) function
---
 .../config/impl/AbstractOIDCSSOConfiguration.java  | 20 ++++++++++---
 .../impl/OIDCCoreProtocolConfigurationTest.java    | 34 +++++++++++++++++++++-
 2 files changed, 49 insertions(+), 5 deletions(-)

diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 03a03cf..8f46fc3 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -42,7 +42,9 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
 import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
 
 /**
  * Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.
@@ -356,10 +358,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
      */
     @Deprecated(since = "2.2.0", forRemoval=true)
     public void setRefreshTokenLifetime(@Nonnull @Positive final Duration lifetime) {
-        Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
-                "Refresh token lifetime must be greater than 0");
-        
-        refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
+        DeprecationSupport.warnOnce(ObjectType.METHOD, "setRefreshTokenLifetime",
+                getClass().getCanonicalName(), "setRefreshTokenTimeout");
+        setRefreshTokenTimeout(lifetime);
     }
 
     /**
@@ -378,6 +379,17 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
     @Override
     @Nonnull @Positive
     public Duration getRefreshTokenTimeout(@Nullable final ProfileRequestContext profileRequestContext) {
+        // the block starting from here can be removed once refreshTokenLifetime is removed
+        final Duration deprecatedLifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
+        if (!Duration.ofHours(2).equals(deprecatedLifetime)) {
+            DeprecationSupport.warnOnce(ObjectType.METHOD, "setRefreshTokenLifetimeLookupStrategy",
+                    getClass().getCanonicalName(), "setRefreshTokenTimeoutLookupStrategy");  
+            Constraint.isTrue(deprecatedLifetime != null && !deprecatedLifetime.isZero() && 
+                    !deprecatedLifetime.isNegative(), "Refresh token lifetime must be greater than 0");
+            return deprecatedLifetime;
+        }
+        // the block ends
+
         final Duration timeout = refreshTokenTimeoutLookupStrategy.apply(profileRequestContext);
         
         Constraint.isTrue(timeout != null && !timeout.isZero() && !timeout.isNegative(),
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java
index 457c969..fe969e2 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java
@@ -54,6 +54,8 @@ public class OIDCCoreProtocolConfigurationTest {
         Assert.assertEquals(config.getIDTokenLifetime(null), Duration.ofHours(1));
         Assert.assertEquals(config.getAccessTokenLifetime(null), Duration.ofMinutes(10));
         Assert.assertEquals(config.getRefreshTokenLifetime(null), Duration.ofHours(2));
+        Assert.assertEquals(config.getRefreshTokenTimeout(null), Duration.ofHours(2));
+        Assert.assertEquals(config.getRefreshTokenChainLifetime(null), Duration.ofHours(2));
         Assert.assertFalse(config.isAcrRequestAlwaysEssential(null));
         Assert.assertTrue(config.getAdditionalAudiencesForIdToken(null).isEmpty());
         Assert.assertTrue(config.isResolveAttributes(null));
@@ -78,8 +80,38 @@ public class OIDCCoreProtocolConfigurationTest {
 
     @Test
     void testsetRefreshTokenLifetime() {
+        Assert.assertEquals(config.getRefreshTokenTimeout(null), Duration.ofHours(2));
         config.setRefreshTokenLifetime(Duration.ofMillis(100));
-        Assert.assertEquals(config.getRefreshTokenLifetime(null), Duration.ofMillis(100));
+        // the deprecated setter sets the timeout
+        Assert.assertEquals(config.getRefreshTokenTimeout(null), Duration.ofMillis(100));
+    }
+
+    @Test
+    void testsetRefreshTokenLifetimeLookupStrategy() {
+        Assert.assertEquals(config.getRefreshTokenTimeout(null), Duration.ofHours(2));
+        config.setRefreshTokenLifetimeLookupStrategy(prc -> Duration.ofMillis(100));
+        // the deprecated setter function should be used in getter for timeout
+        Assert.assertEquals(config.getRefreshTokenTimeout(null), Duration.ofMillis(100));
+    }
+
+    @Test
+    void testsetRefreshTokenTimeout() {
+        Assert.assertEquals(config.getRefreshTokenTimeout(null), Duration.ofHours(2));
+        config.setRefreshTokenTimeout(Duration.ofMillis(100));
+        Assert.assertEquals(config.getRefreshTokenTimeout(null), Duration.ofMillis(100));
+    }
+
+    @Test
+    void testsetRefreshTokenTimeoutLookupStrategy() {
+        Assert.assertEquals(config.getRefreshTokenTimeout(null), Duration.ofHours(2));
+        config.setRefreshTokenTimeoutLookupStrategy(prc -> Duration.ofMillis(100));
+        Assert.assertEquals(config.getRefreshTokenTimeout(null), Duration.ofMillis(100));
+    }
+
+    @Test
+    void testsetRefreshTokenChainLifetime() {
+        config.setRefreshTokenChainLifetime(Duration.ofMillis(100));
+        Assert.assertEquals(config.getRefreshTokenChainLifetime(null), Duration.ofMillis(100));
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.