OAuth Token and TokenAudience interaction

[Kelly,Jeffrey]

Hello,

I’m running into an issue trying to customize access token lifetimes for a particular set of clients.

These clients have their own override block in relying-party.xml, with a custom `accessTokenLifetime` specified for the OAUTH2.Token profile. That override works as expected…with straight OIDC. However, the access tokens being issued to these clients will include 3rd party audiences (they’re being used to get data from a set APIs under our control), so the TokenAudience profile has to be in play for that to work. Since every client we have waiting in the wings is also hot to hit some APIs, the TokenAudience bean sits in the DefaultRelyingParty block.

In nearly every regard, this works perfectly. The clients are able to use the authorization_code grant and get access tokens with the appropriate resource servers in the `aud` claim. The only problem is that the `accessTokenLifetime` value in TokenAudience supersedes the identical setting in the Token configuration, erasing the intended customization. Essentially, if OAuth is enabled, a chunk of client configurability is tossed in favor of the audience’s. While I can see value in being able to configure along the audience axis like this, I need to figure out some way to get shib to “prefer” the configs in the client axis in this case (realistically, we’re bound to have a lot more clients with finnicky requirements than resource servers, so I can’t imagine this will be the last exception we’ll run into like this).

I naively expected that I could simply stick another TokenAudience in the clients’ existing override block, only to realize that it would never trigger because the Relying Party for the TokenAudience flow is the resource server, not the client. While I have a lot of questions about all this, I guess the most practical boils down to this: in this scenario, where two different flows with different RPs are being run through to produce one end result, are those flows “aware” of each other? Is the context of one available to the other? Could I, for instance, define an `accessTokenLifetimeLookupStrategy` in the TokenAudience bean that returns a value based on the id of the *client* that initiated the authentication?

If that’s the wrong tree, are there any others that might be worth barking up?


Jeffrey L. Kelly
Sr. Web/Portal Administrator
Drexel University IT

Drexel University
3141 Chestnut Street
Korman Center - Basement
Philadelphia, PA 19104
Tel: 215.895.6876
drexel.edu<http://www.drexel.edu/>



Drexel Internal Data
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231221/24bce915/attachment.htm>