Refresh OIDC token doesn't work with PrivateKeyJWT configuration
Alexandre Pique
protected TokenRequest createTokenRequest(final AuthorizationGrant grant) {
OidcOpMetadataResolver metadataResolver = configuration.getOpMetadataResolver();
URI tokenEndpointUri = metadataResolver.load().getTokenEndpointURI();
ClientAuthentication clientAuthentication = metadataResolver.getClientAuthentication();
if (clientAuthentication != null) {
if (clientAuthentication instanceof PrivateKeyJWT pvk) {
System.out.println(pvk.getClientAssertion());
metadataResolver.init(true);
metadataResolver.load();
clientAuthentication = metadataResolver.getClientAuthentication();
System.out.println(((PrivateKeyJWT)clientAuthentication).getClientAssertion());
}
return new TokenRequest(
tokenEndpointUri, clientAuthentication, grant, Scope.parse(configuration.getScope()));
} else {
return new TokenRequest(
tokenEndpointUri, new ClientID(configuration.getClientId()), grant, Scope.parse(configuration.getScope()));
}
}
Jérôme LELEU
--
You received this message because you are subscribed to the Google Groups "Pac4j development mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pac4j-dev+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/pac4j-dev/32b832aa-1f6b-4eee-8bcd-f77d91a487b0n%40googlegroups.com.
Alexandre Pique
/**
* Check if the PrivateKeyJWK is expired
* @param i_pvk the key to test
* @return true if expired
*/
public static boolean isJWTExpired(@Nonnull PrivateKeyJWT i_pvk) {
try {
// Gets expiration time in claims (claims can't be null they are built in constructor or it generates an IllegalArgumentExecption
Date expiryTime = i_pvk.getJWTAuthenticationClaimsSet().getExpirationTime();
// Check if the JWT is expired
if (expiryTime == null) {
// No expiration date, not expired
return false;
}
// Check if expiration time is greater than now + some milli-seconds
return expiryTime.before(Date.from(Instant.now().plusMillis(EXPIRATION_TOLERANCE)));
} catch (RuntimeException e) {
logger.errorMessage(e, I_ISLogConstants.kLogError, "An unexpected error occured while checking PrivateKeyJWT expiration occurred");
// In case of error, consider expired
return true;
}
}
/**
* Overrides getClientAuthentication to permits regenerating expired PrivateKeyJWT
* @return In most cases returns supe.getClientAuthentication(), except for expired PrivateKeyJWT
*/
@Override
public ClientAuthentication getClientAuthentication() {
// Gets result of super method
ClientAuthentication auth = super.getClientAuthentication();
// When workaround is enabled, recreate expired PrivateKeyJWT tokens
if ((auth instanceof PrivateKeyJWT pvk) && isJWTExpired(pvk)) {
// Private key signature is expired, recreate it
var privateKeyJwtConfig = configuration.getPrivateKeyJWTClientAuthnMethodConfig();
if (privateKeyJwtConfig != null) {
var jwsAlgo = privateKeyJwtConfig.getJwsAlgorithm();
var privateKey = privateKeyJwtConfig.getPrivateKey();
var keyID = privateKeyJwtConfig.getKeyID();
try {
PrivateKeyJWT newPvk = new PrivateKeyJWT(pvk.getClientID(), this.loaded.getTokenEndpointURI(), jwsAlgo, privateKey, keyID, null);
clientAuthentication = newPvk;
return newPvk;
} catch (final JOSEException e) {
logger.errorMessage(e, I_ISLogConstants.kLogError, "Cannot recreate a new PrivateKeyJWT, use previous token instead");
}
}
}
return auth;
}
Jérôme LELEU
To view this discussion visit https://groups.google.com/d/msgid/pac4j-dev/92699396-7ca5-4256-b8ab-5d91bcd64431n%40googlegroups.com.