[java-idp-oidc] branch main updated: JOIDC-152 - Implement maximum refresh time and/or maximum refresh uses.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=6d308aad4042aaa79f9fd110811f2f2f4a95c56d

The following commit(s) were added to refs/heads/main by this push:
     new 6d308aad JOIDC-152 - Implement maximum refresh time and/or maximum refresh uses.
6d308aad is described below

commit 6d308aad4042aaa79f9fd110811f2f2f4a95c56d
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed May 3 12:44:31 2023 +0300

    JOIDC-152 - Implement maximum refresh time and/or maximum refresh uses.
    
    https://shibboleth.atlassian.net/browse/JOIDC-152
    
    Restored wiring refreshTokenLifetime -property in the MDDriven profile configurations,
    even though it's deprecated. This way we can keep existing deployments behaving in the
    backwards compatible way. The implementing Java class takes care of warning about the
    deprecation, if any non-default value is wired to the deprecated property.
    
    Also included the new properties to the template oidc.properties.
---
 .../net/shibboleth/idp/service/relying-party/postconfig.xml  | 12 ++++++++++--
 .../net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties   |  4 +++-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 491efeb4..6d54ed1c 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -272,7 +272,11 @@
         </property>
         <property name="refreshTokenTimeoutLookupStrategy">
             <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenTimeout"
-                p:defaultValue="%{idp.oidc.refreshToken.defaultTimeout:PT2H}" />
+                p:defaultValue="%{idp.oidc.refreshToken.defaultTimeout:%{idp.oidc.refreshToken.defaultLifetime:PT2H}}" />
+        </property>
+        <property name="refreshTokenLifetimeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenLifetime"
+                p:defaultValue="%{idp.oidc.refreshToken.defaultTimeout:%{idp.oidc.refreshToken.defaultLifetime:PT2H}}" />
         </property>
         <property name="refreshTokenChainLifetimeLookupStrategy">
             <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenChainLifetime"
@@ -418,7 +422,11 @@
         </property>
         <property name="refreshTokenTimeoutLookupStrategy">
             <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenTimeout"
-                p:defaultValue="%{idp.oidc.refreshToken.defaultTimeout:PT2H}" />
+                p:defaultValue="%{idp.oidc.refreshToken.defaultTimeout:%{idp.oidc.refreshToken.defaultLifetime:PT2H}}" />
+        </property>
+        <property name="refreshTokenLifetimeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenLifetime"
+                p:defaultValue="%{idp.oidc.refreshToken.defaultTimeout:%{idp.oidc.refreshToken.defaultLifetime:PT2H}}" />
         </property>
         <property name="refreshTokenChainLifetimeLookupStrategy">
             <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenChainLifetime"
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index 4296aba3..ba5f553b 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -40,7 +40,9 @@ idp.oidc.issuer = https://your.issuer.example.org
 # Default lifetime of OIDC tokens (issued to the client or against the OP itself)
 #idp.oidc.authorizeCode.defaultLifetime = PT5M
 #idp.oidc.accessToken.defaultLifetime = PT10M
-#idp.oidc.refreshToken.defaultLifetime = PT2H
+#idp.oidc.refreshToken.defaultTimeout = PT2H
+#idp.oidc.refreshToken.defaultChainLifetime = PT2H
+
 #idp.oidc.idToken.defaultLifetime = PT1H
 
 # Lifetime of entries in revocation cache for authorize code

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.