<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.spelle
{mso-style-name:spelle;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<div>
<div>
<p class="MsoNormal">Hello,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I’m running into an issue trying to customize access token lifetimes for a particular set of clients.
</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">These clients have their own override block in relying-party.xml, with a custom `accessTokenLifetime` specified for the OAUTH2.Token profile. That override works as expected…with straight OIDC. However, the access tokens being issued to
these clients will include 3<sup>rd</sup> party audiences (they’re being used to get data from a set APIs under our control), so the
<span class="spelle">TokenAudience</span> profile has to be in play for that to work. Since every client we have waiting in the wings is also hot to hit some APIs, the TokenAudience bean sits in the DefaultRelyingParty block.
</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In nearly every regard, this works perfectly. The clients are able to use the
<span class="spelle">authorization_code</span> grant and get access tokens with the appropriate resource servers in the `<span class="spelle">aud</span>` claim. The only problem is that the `<span class="spelle">accessTokenLifetime`</span> value in
<span class="spelle">TokenAudience</span> supersedes the identical setting in the Token configuration, erasing the intended customization. Essentially, if OAuth is enabled, a chunk of client configurability is tossed in favor of the audience’s. While I can
see value in being able to configure along the audience axis like this, I need to figure out some way to get shib to “prefer” the configs in the client axis in this case (realistically, we’re bound to have a lot more clients with finnicky requirements than
resource servers, so I can’t imagine this will be the last exception we’ll run into like this).</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I naively expected that I could simply stick another <span class="spelle">TokenAudience</span> in the clients’ existing override block, only to realize that it would never trigger because the Relying Party for the TokenAudience flow is
the resource server, not the client. While I have a lot of questions about all this, I guess the most practical boils down to this: in this scenario, where two different flows with different RPs are being run through to produce one end result, are those flows
“aware” of each other? Is the context of one available to the other? Could I, for instance, define an `accessTokenLifetimeLookupStrategy` in the TokenAudience bean that returns a value based on the id of the *<b>client</b>* that initiated the authentication?</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If that’s the wrong tree, are there any others that might be worth barking up?</p>
<p class="MsoNormal"> </p>
<div>
<div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003478">Jeffrey L. Kelly</span></b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
<i>Sr. Web/Portal Administrator<br>
Drexel University IT</i></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"> </span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003478">Drexel University</span></b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
3141 Chestnut Street<br>
<span class="spelle">Korman</span> Center - Basement<br>
Philadelphia, PA 19104<br>
Tel: 215.895.6876<br>
</span><a href="http://www.drexel.edu/"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">drexel.edu</span></a></p>
</div>
</div>
<p class="MsoNormal"> </p>
</div>
</div>
</div>
<br>
<p style="font-family:Calibri;font-size:10pt;color:#000000;margin:5pt;font-style:normal;font-weight:normal;text-decoration:none;" align="Left">
Drexel Internal Data<br>
</p>
</body>
</html>