[java-idp-oidc] branch main updated: JOIDC-154 - Improve authorization_code replay revocation lifetime

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=18b79f02ab2851eb7411f9fb1258190124c5e084

The following commit(s) were added to refs/heads/main by this push:
     new 18b79f02 JOIDC-154 - Improve authorization_code replay revocation lifetime
18b79f02 is described below

commit 18b79f02ab2851eb7411f9fb1258190124c5e084
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 5 14:03:52 2023 +0300

    JOIDC-154 - Improve authorization_code replay revocation lifetime
    
    https://shibboleth.atlassian.net/browse/JOIDC-154
    
    Wire the XML config for ValidateGrant in the same way as Java-constructor
    already does: sets 'useActiveProfileOnly' flag to 'false' for the lookup function
    for revocation lifetime. This will make the lookup function to check if the
    relying party configuration contains revocation profile, and uses the lifetime from
    its options if found. If not, then the default value is used.
---
 .../META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 2fb128ce..f92af65d 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -66,7 +66,7 @@
         p:revocationCache-ref="shibboleth.oidc.RevocationCache">
         <property name="chainRevocationLifetimeLookupStrategy">
             <bean class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultChainRevocationLifetimeLookupStrategy"
-                p:clockSkew="%{idp.policy.clockSkew:PT5M}" />
+                p:clockSkew="%{idp.policy.clockSkew:PT5M}" p:useActiveProfileOnly="false" />
         </property>
     </bean>
     

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.