Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change or skip allowed time skew for ID token issue time validation #1033

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

Mardaneus86
Copy link

Checklist

  • I read the Contribution Guidelines
  • I signed the CLA and WG Agreements
  • I ran, updated and added unit tests as necessary.
  • I verified the contribution matches existing coding style.
  • I updated the documentation if necessary.

Motivation and Context

Change aims to address issue in #830 by adding the ability to either disable or change the allowed time skew for the ID Token issued at time (iat). Changing the allowed time skew can be useful because the clock on some devices can go beyond the default of 10 minutes. The OIDC specs do not define a specific timeframe, and the default of 10 minutes is still used when the new options are not used.

Description

I followed a similar approach as #662 already did for skipping the issuer https check.

AppAuthConfiguration appAuthConfig = new AppAuthConfiguration.Builder()
    .setAllowedIssueTimeSkew(THIRTY_MINUTES_IN_SECONDS)
    .build()
AppAuthConfiguration appAuthConfig = new AppAuthConfiguration.Builder()
    .setSkipIssueTimeValidation(true)
    .build()

Allows to completely disable ID tokens issue time validation, or change the default of 10 minutes to a custom allowed time skew in seconds.
@brighthr-stanton
Copy link

This is a feature we've been waiting for for so long! Please review and accept, and we can move on from depending on v0.7.1 of the library :)

@brighthr-stanton
Copy link

Hi repo maintainers :) , Any news on this? Have been waiting for a month.... @WilliamDenniss @iainmcgin @StevenEWright

@brighthr-stanton
Copy link

agologan I see you seem to be one of the maintainers now? forgive me if I've misunderstood that. Any response to this PR please? We have been waiting a long time for this to be fixed.

@sanduluca
Copy link

Any news on this ?

@sanduluca
Copy link

@agologan Can you check this PR please ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants