[java-oidfed-common] 01/03: Fix the expiration time calculation for the local response cache container

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidfed-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/7563294204bf4ef6da0e4bb71e62ff043c3990b0

commit 7563294204bf4ef6da0e4bb71e62ff043c3990b0
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Oct 9 08:18:29 2026 +0300

    Fix the expiration time calculation for the local response cache container
    
    - Take the JWT claims set's expiration into account
---
 ...busResponseContainerExpirationTimeStrategy.java | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java
index 4765f4e..c6655e8 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java
@@ -14,6 +14,7 @@
 
 package net.shibboleth.oidfed.metadata.cache.local;
 
+import java.text.ParseException;
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -21,12 +22,15 @@ import java.util.List;
 import java.util.Optional;
 import java.util.function.Function;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.annotation.concurrent.ThreadSafe;
 
-import com.nimbusds.openid.connect.sdk.federation.config.FederationEntityConfigurationSuccessResponse;
+import org.slf4j.Logger;
 
 import net.shibboleth.oidc.metadata.cache.ExpirationTimeContext;
+import net.shibboleth.oidfed.messaging.impl.AbstractSignedJWTResponse;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Default strategy for fetching expiration time for the Nimbus response container. The expiration instant
@@ -37,6 +41,10 @@ import net.shibboleth.oidc.metadata.cache.ExpirationTimeContext;
 public class DefaultNimbusResponseContainerExpirationTimeStrategy
         implements Function<ExpirationTimeContext<NimbusResponseContainer>, Instant> {
 
+    /** Class logger. */
+    @Nonnull
+    private final Logger log = LoggerFactory.getLogger(DefaultNimbusResponseContainerExpirationTimeStrategy.class);
+
     /** {@inheritDoc} */
     @Nullable public Instant apply(@Nullable final ExpirationTimeContext<NimbusResponseContainer> context) {
         if (context == null) {
@@ -48,10 +56,14 @@ public class DefaultNimbusResponseContainerExpirationTimeStrategy
             return contextExpiration;
         }
         final List<Instant> expirations = new ArrayList<>(List.of(contextExpiration, container.getExpirationInstant()));
-        if (container.getResponse() instanceof FederationEntityConfigurationSuccessResponse successResponse) {
-            Optional.ofNullable(successResponse.getEntityStatement().getClaimsSet().getExpirationTime())
-                .map(date -> date.toInstant())
-                .ifPresent(instant -> expirations.add(instant));
+        if (container.getResponse() instanceof AbstractSignedJWTResponse response) {
+            try {
+                Optional.ofNullable(response.getJWT().getJWTClaimsSet().getExpirationTime())
+                    .map(date -> date.toInstant())
+                    .ifPresent(instant -> expirations.add(instant));
+            } catch (final ParseException e) {
+                log.error("Could not parse JWT claims set of {} for fetching its expiration instant", response, e);
+            }
         }
         return Collections.min(expirations);
     }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.