Add OIDC property for configuring internal ID token lifespan #30213
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
gastaldi
reviewed
Jan 5, 2023
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcTenantConfig.java
Show resolved
Hide resolved
This comment has been minimized.
This comment has been minimized.
sberyozkin
force-pushed
the
oidc_internal_idtoken_lifetime
branch
from
7bda9b6 to
6d3e89b
Compare
gastaldi
approved these changes
Jan 5, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #30111.
Simple PR to allow configuring an internal ID token lifespan with the OIDC specific property since relying on the global smallrye jwt property may not always be possible.
Internal ID tokens are generated when GitHub or other OAuth2 only providers do not provide them. Default lifespan is 5 mins which is not a problem if a browser is used directly to authenticate to Quarkus via GitHub because after it expires and the redirect to GitHub is initiated GitHub does not itself challenge since as its own session is still valid (at least it was the case the last time I tried it). But it poses a problem for Ajax/SPA based applications.
Therefore it makes sense to let users configure the internal ID token lifespan at the OIDC level to a large enough value, and then use a local logout technique whenever the token age exceeds the acceptable limits.
Updated the wiremock test to confirm
300(5 min) is a default lifespan for the internal id tokens, but can be changed if needed (ex to 301 as in the test)CC @kucharzyk