[JIRA] (JOIDC-154) Improve authorization_code replay revocation lifetime

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiMzFhMjJjZWVmNmJmNDlmNzg2OTgwZTMxYWVmM2NjOTUiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/JOIDC-154?atlOrigin=eyJpIjoiMzFhMjJjZWVmNmJmNDlmNzg2OTgwZTMxYWVmM2NjOTUiLCJwIjoiaiJ9 ) JOIDC-154 ( https://shibboleth.atlassian.net/browse/JOIDC-154?atlOrigin=eyJpIjoiMzFhMjJjZWVmNmJmNDlmNzg2OTgwZTMxYWVmM2NjOTUiLCJwIjoiaiJ9 ) Improve authorization_code replay revocation lifetime ( https://shibboleth.atlassian.net/browse/JOIDC-154?atlOrigin=eyJpIjoiMzFhMjJjZWVmNmJmNDlmNzg2OTgwZTMxYWVmM2NjOTUiLCJwIjoiaiJ9 )

Issue Type: Improvement Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Components: Token Endpoint Created: 05/May/23 6:52 AM Fix Versions: 3.4.0 Priority: Trivial Reporter: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd )

We’ve documented the replay and revocation process here: https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2931327005/OPToken#Replay-and-Revocation

It currently states that the property *idp.oidc.revocationCache.authorizeCode.lifetime* is used for controlling the lifetime for entries stored to revocation cache regarding whole token chains.

The documentation is correct, but the codebase also provides method for using the revocationLifetime option from the revocation profile (see https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879313/OPRevocation#Configuration ). The function is not just wired properly currently, causing the following log-lines when authorization code replay has been detected:

2023-05-05 07:05:05,866 -  - ERROR [net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrant:245] - Profile Action ValidateGrant: Replay detected of authz code _d4e47dfb3b4b7f53209ce21834d5e141
2023-05-05 07:05:05,866 -  - WARN [net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrant:356] - Profile Action ValidateGrant: No profile-specific revocation lifetime could be resolved, using default value
2023-05-05 07:05:05,867 -  - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidGrant

The second line contains a message “ No profile-specific revocation lifetime could be resolved, using default value ", which refers to the fact that the value set via property *idp.oidc.revocationCache.authorizeCode.lifetime* is used. Better option would be to use the revocationLifetime value instead, as then the replay revocation record lifetime would match the profile configuration option used for revocation. By default it’s also using the same property though.

( https://shibboleth.atlassian.net/browse/JOIDC-154#add-comment?atlOrigin=eyJpIjoiMzFhMjJjZWVmNmJmNDlmNzg2OTgwZTMxYWVmM2NjOTUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-154#add-comment?atlOrigin=eyJpIjoiMzFhMjJjZWVmNmJmNDlmNzg2OTgwZTMxYWVmM2NjOTUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:7f918b6 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230505/bb8dbf25/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-39663486-f754-4900-9e9c-b80d11d6b612
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230505/bb8dbf25/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-c96865e0-81c9-450c-8e5a-8a18a13fd079
Type: image/png
Size: 448 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230505/bb8dbf25/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-222a2848-4bfd-45cc-9f6f-b0d65d529292
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230505/bb8dbf25/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-d9c09865-6662-45cc-baea-562871a8664d
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230505/bb8dbf25/attachment-0007.png>