[java-oidc-common] branch main updated: JCOMOIDC-111 - Remove exp-claim requirement for JWTIdentifierClaimsValidator

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=8ec4afcae6724643edbbc8639f9d6199da1e3b28

The following commit(s) were added to refs/heads/main by this push:
     new 8ec4afc  JCOMOIDC-111 - Remove exp-claim requirement for JWTIdentifierClaimsValidator
8ec4afc is described below

commit 8ec4afcae6724643edbbc8639f9d6199da1e3b28
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 3 16:47:35 2024 +0300

    JCOMOIDC-111 - Remove exp-claim requirement for JWTIdentifierClaimsValidator
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-111
    
    Included replayCacheRecordLifetime -property, defaulting to null for compatibility.
    If it has a value, it's used for the storage record if exp-claim is not included
    in the claims set.
---
 .../claims/impl/JWTIdentifierClaimsValidator.java  | 33 +++++++++++++++++++---
 1 file changed, 29 insertions(+), 4 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierClaimsValidator.java
index 5a94784..eb84d38 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierClaimsValidator.java
@@ -49,11 +49,19 @@ public class JWTIdentifierClaimsValidator extends AbstractClaimsValidator {
      */
     @Nonnull private Duration clockSkew;
 
+    /**
+     * Static lifetime to be used in replay cache if claims set doesn't contain expiration value.
+     */
+    @Nullable private Duration replayCacheRecordLifetime;
+
     /**
      * Constructor.
      */
     public JWTIdentifierClaimsValidator() {
-        clockSkew = Duration.ofMinutes(1);
+        final Duration oneMinute = Duration.ofMinutes(1);
+        assert oneMinute != null;
+        clockSkew = oneMinute;
+        replayCacheRecordLifetime = null;
     }
     
     /**
@@ -76,6 +84,18 @@ public class JWTIdentifierClaimsValidator extends AbstractClaimsValidator {
         clockSkew = Constraint.isNotNull(skew, "Clock skew cannot be null");
     }
 
+    /**
+     * Set the static lifetime to be used in replay cache if claims set doesn't contain expiration value.
+     * 
+     * @param lifetime record lifetime to set.
+     * 
+     * @since 3.2.0
+     */
+    public void setReplayCacheRecordLifetime(@Nullable final Duration lifetime) {
+        ifInitializedThrowUnmodifiabledComponentException();
+        replayCacheRecordLifetime = lifetime;
+    }
+
     /** {@inheritDoc} */
     @Override
     protected void doInitialize() throws ComponentInitializationException {
@@ -92,15 +112,20 @@ public class JWTIdentifierClaimsValidator extends AbstractClaimsValidator {
                 throws JWTValidationException {
 
         final Date exp = claims.getExpirationTime();
+        final Instant expiry;
         if (exp == null) {
-            throw new JWTValidationException("The claims set is missing required expiration time (exp)");
+            if (replayCacheRecordLifetime == null) {
+                throw new JWTValidationException("The claims set is missing required expiration time (exp)");
+            }
+            expiry = Instant.now().plus(replayCacheRecordLifetime);
+        } else {
+            expiry = exp.toInstant().plus(clockSkew);
         }
         final String jit = claims.getJWTID();
         if (StringSupport.trimOrNull(jit) == null) {
             throw new JWTValidationException("The claims set is missing required JWT identifier (jit)");
         }
-        final String className = getClass().getName();        
-        final Instant expiry = exp.toInstant().plus(clockSkew);
+        final String className = getClass().getName();
         assert className != null && jit != null && expiry != null;
         if (!replayCache.check(className, jit, expiry)) {
             throw new JWTValidationException("Replay detected for jit '" + jit + "'");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.