[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-79 - Add clockSkew to AuthenticationRequestTimeLookupFunction

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
https://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=12a1519b775225d6951f2536214618e713893a4b

The following commit(s) were added to refs/heads/main by this push:
     new 12a1519  JOIDCRP-79 - Add clockSkew to AuthenticationRequestTimeLookupFunction
12a1519 is described below

commit 12a1519b775225d6951f2536214618e713893a4b
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Nov 13 11:33:16 2025 +0000

    JOIDCRP-79 - Add clockSkew to AuthenticationRequestTimeLookupFunction
    
     - Add a clockskew to the authentication request time lookup strategy.
    Set it to 0s to be compatible with existing behaviour.
     - Expose a new property for setting it.
    
    https://shibboleth.atlassian.net/browse/JOIDCRP-79
---
 .../AuthenticationRequestTimeLookupFunction.java   | 23 +++++++++++++++++++++-
 .../oidc-relying-party-authn-beans.xml             |  3 ++-
 .../authn/oidc/rp/conf/authn/oidc-rp.properties    |  1 +
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AuthenticationRequestTimeLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AuthenticationRequestTimeLookupFunction.java
index 551ec76..a41ff18 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AuthenticationRequestTimeLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AuthenticationRequestTimeLookupFunction.java
@@ -14,6 +14,7 @@
 
 package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
 
+import java.time.Duration;
 import java.time.Instant;
 import java.util.function.Function;
 
@@ -37,6 +38,13 @@ public class AuthenticationRequestTimeLookupFunction implements Function<Profile
      */
     @Nonnull private Function<ProfileRequestContext, OIDCAuthenticationRequest> authenticationRequestLookupStrategy;
     
+    /** 
+     * A clock skew to apply to the authentication request time. This accounts for differences between system clocks by
+     * treating the authentication request as if it occurred slightly earlier by the specified skew duration. By default
+     * there is no skew.
+     */
+    @Nonnull private Duration clockSkew;
+    
     /** Constructor.*/
     public AuthenticationRequestTimeLookupFunction() {
         authenticationRequestLookupStrategy = prc -> {
@@ -46,6 +54,18 @@ public class AuthenticationRequestTimeLookupFunction implements Function<Profile
             }
             return null;
         };   
+        final Duration ofSeconds = Duration.ofSeconds(0);
+        assert ofSeconds != null;
+        clockSkew = ofSeconds;
+    }
+    
+    /**
+     * Set the clock skew.
+     * 
+     * @param skew clock skew to set
+     */
+    public void setClockSkew(@Nonnull final Duration skew) {          
+        clockSkew = Constraint.isNotNull(skew, "Clock skew cannot be null");
     }
     
     /**
@@ -65,7 +85,8 @@ public class AuthenticationRequestTimeLookupFunction implements Function<Profile
             return null;
         }
         final OIDCAuthenticationRequest authnRequest = authenticationRequestLookupStrategy.apply(input);
-        return authnRequest == null ? null : authnRequest.getAuthnRequestTime();
+        final Instant authTime = authnRequest == null ? null : authnRequest.getAuthnRequestTime();
+        return authTime == null ? null : authTime.minus(clockSkew);
     }
 
 }
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index f9c56bf..82b28a5 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -658,7 +658,8 @@
         c:maxAgeDefault="%{idp.authn.oidc.rp.client.idtoken.jwt.verifier.authnLifetime:PT60S}"/>
         
     <bean id="AuthenticationRequestTimeLookupFunction" 
-        class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.AuthenticationRequestTimeLookupFunction"/>  
+        class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.AuthenticationRequestTimeLookupFunction"
+        p:clockSkew="%{idp.authn.oidc.rp.client.idtoken.jwt.verifier.authnRequestClockSkew:PT0S}"/>  
 
     <bean id="DefaultAuthTimeActivationCondition" 
             class="net.shibboleth.oidc.security.jwt.claims.impl.AuthTimeRequestedActivationCondition"
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
index d3dae91..4648020 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
@@ -30,6 +30,7 @@ idp.authn.oidc.rp.client.redirecturl.allowedOrigins = https://localhost:8443
 ## IDToken JWT verification properties
 #idp.authn.oidc.rp.client.idtoken.jwt.verifier.clockSkew = PT60S
 #idp.authn.oidc.rp.client.idtoken.jwt.verifier.authnLifetime = PT60S
+#idp.authn.oidc.rp.client.idtoken.jwt.verifier.authnRequestClockSkew = PT0S 
 ## General JWT verification properties
 #idp.authn.oidc.rp.client.jwt.verifier.clockSkew = PT1M
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.