Skip to content

Commit 2b39045

Browse files
mdisabatinomdisabatino
committed
[SYNCOPE-1950] Allow configuration of OIDC Token Expiration Policy in WA
1 parent b8e988a commit 2b39045

File tree

9 files changed

+317
-1
lines changed

9 files changed

+317
-1
lines changed

‎client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppModalPanelBuilder.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -465,6 +465,38 @@ public void setObject(final String object) {
465465
false);
466466
tokenEndpointAuthenticationMethod.setChoices(List.of(OIDCClientAuthenticationMethod.values()));
467467
fields.add(tokenEndpointAuthenticationMethod);
468+
469+
AjaxTextFieldPanel accessTokenMaxTimeToLive = new AjaxTextFieldPanel(
470+
"field", "accessTokenMaxTimeToLive",
471+
new PropertyModel<>(clientAppTO, "accessTokenMaxTimeToLive"), false);
472+
fields.add(accessTokenMaxTimeToLive);
473+
474+
AjaxTextFieldPanel accessTokenTimeToKill = new AjaxTextFieldPanel(
475+
"field", "accessTokenTimeToKill", new PropertyModel<>(clientAppTO, "accessTokenTimeToKill"),
476+
false);
477+
fields.add(accessTokenTimeToKill);
478+
479+
AjaxNumberFieldPanel<Long> accessTokenMaxActiveTokens = new AjaxNumberFieldPanel.Builder<Long>()
480+
.enableOnChange()
481+
.build("field", "accessTokenMaxActiveTokens", Long.class,
482+
new PropertyModel<>(clientAppTO, "accessTokenMaxActiveTokens"));
483+
fields.add(accessTokenMaxActiveTokens);
484+
485+
AjaxTextFieldPanel refreshTokenTimeToKill = new AjaxTextFieldPanel(
486+
"field", "refreshTokenTimeToKill",
487+
new PropertyModel<>(clientAppTO, "refreshTokenTimeToKill"), false);
488+
fields.add(refreshTokenTimeToKill);
489+
490+
AjaxNumberFieldPanel<Long> refreshTokenMaxActiveTokens = new AjaxNumberFieldPanel.Builder<Long>()
491+
.enableOnChange()
492+
.build("field", "refreshTokenMaxActiveTokens", Long.class,
493+
new PropertyModel<>(clientAppTO, "refreshTokenMaxActiveTokens"));
494+
fields.add(refreshTokenMaxActiveTokens);
495+
496+
AjaxTextFieldPanel deviceTokenTimeToKill = new AjaxTextFieldPanel(
497+
"field", "deviceTokenTimeToKill", new PropertyModel<>(clientAppTO, "deviceTokenTimeToKill"),
498+
false);
499+
fields.add(deviceTokenTimeToKill);
468500
break;
469501

470502
case SAML2SP:

‎common/am/lib/src/main/java/org/apache/syncope/common/lib/to/OIDCRPClientAppTO.java‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,18 @@ public class OIDCRPClientAppTO extends ClientAppTO {
8282

8383
private String jwksUri;
8484

85+
private String accessTokenMaxTimeToLive;
86+
87+
private String accessTokenTimeToKill;
88+
89+
private Long accessTokenMaxActiveTokens;
90+
91+
private String refreshTokenTimeToKill;
92+
93+
private Long refreshTokenMaxActiveTokens;
94+
95+
private String deviceTokenTimeToKill;
96+
8597
private OIDCClientAuthenticationMethod tokenEndpointAuthenticationMethod =
8698
OIDCClientAuthenticationMethod.client_secret_basic;
8799

@@ -272,6 +284,54 @@ public void setLogoutUri(final String logoutUri) {
272284
this.logoutUri = logoutUri;
273285
}
274286

287+
public String getAccessTokenMaxTimeToLive() {
288+
return accessTokenMaxTimeToLive;
289+
}
290+
291+
public void setAccessTokenMaxTimeToLive(final String accessTokenMaxTimeToLive) {
292+
this.accessTokenMaxTimeToLive = accessTokenMaxTimeToLive;
293+
}
294+
295+
public String getAccessTokenTimeToKill() {
296+
return accessTokenTimeToKill;
297+
}
298+
299+
public void setAccessTokenTimeToKill(final String accessTokenTimeToKill) {
300+
this.accessTokenTimeToKill = accessTokenTimeToKill;
301+
}
302+
303+
public Long getAccessTokenMaxActiveTokens() {
304+
return accessTokenMaxActiveTokens;
305+
}
306+
307+
public void setAccessTokenMaxActiveTokens(final Long accessTokenMaxActiveTokens) {
308+
this.accessTokenMaxActiveTokens = accessTokenMaxActiveTokens;
309+
}
310+
311+
public String getRefreshTokenTimeToKill() {
312+
return refreshTokenTimeToKill;
313+
}
314+
315+
public void setRefreshTokenTimeToKill(final String refreshTokenTimeToKill) {
316+
this.refreshTokenTimeToKill = refreshTokenTimeToKill;
317+
}
318+
319+
public Long getRefreshTokenMaxActiveTokens() {
320+
return refreshTokenMaxActiveTokens;
321+
}
322+
323+
public void setRefreshTokenMaxActiveTokens(final Long refreshTokenMaxActiveTokens) {
324+
this.refreshTokenMaxActiveTokens = refreshTokenMaxActiveTokens;
325+
}
326+
327+
public String getDeviceTokenTimeToKill() {
328+
return deviceTokenTimeToKill;
329+
}
330+
331+
public void setDeviceTokenTimeToKill(final String deviceTokenTimeToKill) {
332+
this.deviceTokenTimeToKill = deviceTokenTimeToKill;
333+
}
334+
275335
@Override
276336
public boolean equals(final Object obj) {
277337
if (obj == null) {
@@ -310,6 +370,12 @@ public boolean equals(final Object obj) {
310370
.append(this.jwksUri, rhs.jwksUri)
311371
.append(this.tokenEndpointAuthenticationMethod, rhs.tokenEndpointAuthenticationMethod)
312372
.append(this.logoutUri, rhs.logoutUri)
373+
.append(this.accessTokenMaxTimeToLive, rhs.accessTokenMaxTimeToLive)
374+
.append(this.accessTokenTimeToKill, rhs.accessTokenTimeToKill)
375+
.append(this.accessTokenMaxActiveTokens, rhs.accessTokenMaxActiveTokens)
376+
.append(this.refreshTokenTimeToKill, rhs.accessTokenTimeToKill)
377+
.append(this.refreshTokenMaxActiveTokens, rhs.refreshTokenMaxActiveTokens)
378+
.append(this.deviceTokenTimeToKill, rhs.deviceTokenTimeToKill)
313379
.isEquals();
314380
}
315381

@@ -341,6 +407,12 @@ public int hashCode() {
341407
.append(jwksUri)
342408
.append(tokenEndpointAuthenticationMethod)
343409
.append(logoutUri)
410+
.append(accessTokenMaxTimeToLive)
411+
.append(accessTokenTimeToKill)
412+
.append(accessTokenMaxActiveTokens)
413+
.append(refreshTokenTimeToKill)
414+
.append(refreshTokenMaxActiveTokens)
415+
.append(deviceTokenTimeToKill)
344416
.toHashCode();
345417
}
346418
}

‎core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/OIDCRPClientApp.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,4 +118,27 @@ public interface OIDCRPClientApp extends ClientApp {
118118

119119
void setLogoutUri(String logoutUri);
120120

121+
String getDeviceTokenTimeToKill();
122+
123+
void setDeviceTokenTimeToKill(String deviceTokenTimeToKill);
124+
125+
Long getRefreshTokenMaxActiveTokens();
126+
127+
void setRefreshTokenMaxActiveTokens(Long refreshTokenMaxActiveTokens);
128+
129+
String getRefreshTokenTimeToKill();
130+
131+
void setRefreshTokenTimeToKill(String refreshTokenTimeToKill);
132+
133+
Long getAccessTokenMaxActiveTokens();
134+
135+
void setAccessTokenMaxActiveTokens(Long accessTokenMaxActiveTokens);
136+
137+
String getAccessTokenTimeToKill();
138+
139+
void setAccessTokenTimeToKill(String accessTokenTimeToKill);
140+
141+
String getAccessTokenMaxTimeToLive();
142+
143+
void setAccessTokenMaxTimeToLive(String accessTokenMaxTimeToLive);
121144
}

‎core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAOIDCRPClientApp.java‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,18 @@ public class JPAOIDCRPClientApp extends AbstractClientApp implements OIDCRPClien
142142

143143
private String logoutUri;
144144

145+
private String accessTokenMaxTimeToLive;
146+
147+
private String accessTokenTimeToKill;
148+
149+
private Long accessTokenMaxActiveTokens;
150+
151+
private String refreshTokenTimeToKill;
152+
153+
private Long refreshTokenMaxActiveTokens;
154+
155+
private String deviceTokenTimeToKill;
156+
145157
@Override
146158
public Set<String> getRedirectUris() {
147159
return redirectUrisSet;
@@ -364,6 +376,66 @@ public void setLogoutUri(final String logoutUri) {
364376
this.logoutUri = logoutUri;
365377
}
366378

379+
@Override
380+
public String getDeviceTokenTimeToKill() {
381+
return deviceTokenTimeToKill;
382+
}
383+
384+
@Override
385+
public void setDeviceTokenTimeToKill(final String deviceTokenTimeToKill) {
386+
this.deviceTokenTimeToKill = deviceTokenTimeToKill;
387+
}
388+
389+
@Override
390+
public Long getRefreshTokenMaxActiveTokens() {
391+
return refreshTokenMaxActiveTokens;
392+
}
393+
394+
@Override
395+
public void setRefreshTokenMaxActiveTokens(final Long refreshTokenMaxActiveTokens) {
396+
this.refreshTokenMaxActiveTokens = refreshTokenMaxActiveTokens;
397+
}
398+
399+
@Override
400+
public String getRefreshTokenTimeToKill() {
401+
return refreshTokenTimeToKill;
402+
}
403+
404+
@Override
405+
public void setRefreshTokenTimeToKill(final String refreshTokenTimeToKill) {
406+
this.refreshTokenTimeToKill = refreshTokenTimeToKill;
407+
}
408+
409+
@Override
410+
public Long getAccessTokenMaxActiveTokens() {
411+
return accessTokenMaxActiveTokens;
412+
}
413+
414+
@Override
415+
public void setAccessTokenMaxActiveTokens(final Long accessTokenMaxActiveTokens) {
416+
this.accessTokenMaxActiveTokens = accessTokenMaxActiveTokens;
417+
}
418+
419+
@Override
420+
public String getAccessTokenTimeToKill() {
421+
return accessTokenTimeToKill;
422+
}
423+
424+
@Override
425+
public void setAccessTokenTimeToKill(final String accessTokenTimeToKill) {
426+
this.accessTokenTimeToKill = accessTokenTimeToKill;
427+
}
428+
429+
@Override
430+
public String getAccessTokenMaxTimeToLive() {
431+
return accessTokenMaxTimeToLive;
432+
}
433+
434+
@Override
435+
public void setAccessTokenMaxTimeToLive(final String accessTokenMaxTimeToLive) {
436+
this.accessTokenMaxTimeToLive = accessTokenMaxTimeToLive;
437+
}
438+
367439
protected void json2list(final boolean clearFirst) {
368440
if (clearFirst) {
369441
getRedirectUris().clear();

‎core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/entity/am/Neo4jOIDCRPClientApp.java‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,19 @@ public class Neo4jOIDCRPClientApp extends AbstractClientApp implements OIDCRPCli
119119

120120
private String logoutUri;
121121

122+
123+
private String accessTokenMaxTimeToLive;
124+
125+
private String accessTokenTimeToKill;
126+
127+
private Long accessTokenMaxActiveTokens;
128+
129+
private String refreshTokenTimeToKill;
130+
131+
private Long refreshTokenMaxActiveTokens;
132+
133+
private String deviceTokenTimeToKill;
134+
122135
@Override
123136
public Set<String> getRedirectUris() {
124137
return redirectUrisSet;
@@ -341,6 +354,55 @@ public void setLogoutUri(final String logoutUri) {
341354
this.logoutUri = logoutUri;
342355
}
343356

357+
358+
public String getDeviceTokenTimeToKill() {
359+
return deviceTokenTimeToKill;
360+
}
361+
362+
public void setDeviceTokenTimeToKill(final String deviceTokenTimeToKill) {
363+
this.deviceTokenTimeToKill = deviceTokenTimeToKill;
364+
}
365+
366+
public Long getRefreshTokenMaxActiveTokens() {
367+
return refreshTokenMaxActiveTokens;
368+
}
369+
370+
public void setRefreshTokenMaxActiveTokens(final Long refreshTokenMaxActiveTokens) {
371+
this.refreshTokenMaxActiveTokens = refreshTokenMaxActiveTokens;
372+
}
373+
374+
public String getRefreshTokenTimeToKill() {
375+
return refreshTokenTimeToKill;
376+
}
377+
378+
public void setRefreshTokenTimeToKill(final String refreshTokenTimeToKill) {
379+
this.refreshTokenTimeToKill = refreshTokenTimeToKill;
380+
}
381+
382+
public Long getAccessTokenMaxActiveTokens() {
383+
return accessTokenMaxActiveTokens;
384+
}
385+
386+
public void setAccessTokenMaxActiveTokens(final Long accessTokenMaxActiveTokens) {
387+
this.accessTokenMaxActiveTokens = accessTokenMaxActiveTokens;
388+
}
389+
390+
public String getAccessTokenTimeToKill() {
391+
return accessTokenTimeToKill;
392+
}
393+
394+
public void setAccessTokenTimeToKill(final String accessTokenTimeToKill) {
395+
this.accessTokenTimeToKill = accessTokenTimeToKill;
396+
}
397+
398+
public String getAccessTokenMaxTimeToLive() {
399+
return accessTokenMaxTimeToLive;
400+
}
401+
402+
public void setAccessTokenMaxTimeToLive(final String accessTokenMaxTimeToLive) {
403+
this.accessTokenMaxTimeToLive = accessTokenMaxTimeToLive;
404+
}
405+
344406
protected void json2list(final boolean clearFirst) {
345407
if (clearFirst) {
346408
getRedirectUris().clear();

‎core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ClientAppDataBinderImpl.java‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,12 @@ protected void doUpdate(final OIDCRPClientApp clientApp, final OIDCRPClientAppTO
257257
clientApp.setJwks(clientAppTO.getJwks());
258258
clientApp.setJwksUri(clientAppTO.getJwksUri());
259259
clientApp.setTokenEndpointAuthenticationMethod(clientAppTO.getTokenEndpointAuthenticationMethod());
260+
clientApp.setAccessTokenMaxActiveTokens(clientAppTO.getAccessTokenMaxActiveTokens());
261+
clientApp.setAccessTokenMaxTimeToLive(clientAppTO.getAccessTokenMaxTimeToLive());
262+
clientApp.setAccessTokenTimeToKill(clientAppTO.getAccessTokenTimeToKill());
263+
clientApp.setRefreshTokenMaxActiveTokens(clientAppTO.getRefreshTokenMaxActiveTokens());
264+
clientApp.setRefreshTokenTimeToKill(clientAppTO.getRefreshTokenTimeToKill());
265+
clientApp.setDeviceTokenTimeToKill(clientAppTO.getDeviceTokenTimeToKill());
260266
}
261267

262268
protected OIDCRPClientAppTO getOIDCClientAppTO(final OIDCRPClientApp clientApp) {
@@ -289,7 +295,12 @@ protected OIDCRPClientAppTO getOIDCClientAppTO(final OIDCRPClientApp clientApp)
289295
clientAppTO.setJwks(clientApp.getJwks());
290296
clientAppTO.setJwksUri(clientApp.getJwksUri());
291297
clientAppTO.setTokenEndpointAuthenticationMethod(clientApp.getTokenEndpointAuthenticationMethod());
292-
298+
clientAppTO.setAccessTokenMaxActiveTokens(clientApp.getAccessTokenMaxActiveTokens());
299+
clientAppTO.setAccessTokenMaxTimeToLive(clientApp.getAccessTokenMaxTimeToLive());
300+
clientAppTO.setAccessTokenTimeToKill(clientApp.getAccessTokenTimeToKill());
301+
clientAppTO.setRefreshTokenTimeToKill(clientApp.getRefreshTokenTimeToKill());
302+
clientAppTO.setRefreshTokenMaxActiveTokens(clientApp.getRefreshTokenMaxActiveTokens());
303+
clientAppTO.setDeviceTokenTimeToKill(clientApp.getDeviceTokenTimeToKill());
293304
return clientAppTO;
294305
}
295306

‎fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -958,6 +958,13 @@ protected static OIDCRPClientAppTO buildOIDCRP() {
958958

959959
oidcrpTO.setAuthPolicy(authPolicyTO.getKey());
960960
oidcrpTO.setAccessPolicy(accessPolicyTO.getKey());
961+
962+
oidcrpTO.setAccessTokenMaxActiveTokens(0L);
963+
oidcrpTO.setAccessTokenMaxTimeToLive("PT8H");
964+
oidcrpTO.setAccessTokenTimeToKill("PT2H");
965+
oidcrpTO.setRefreshTokenMaxActiveTokens(0L);
966+
oidcrpTO.setRefreshTokenTimeToKill("P14D");
967+
oidcrpTO.setDeviceTokenTimeToKill("PT5M");
961968

962969
return oidcrpTO;
963970
}

‎fit/core-reference/src/test/java/org/apache/syncope/fit/core/ClientAppITCase.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ public void readOIDCRP() {
121121
assertFalse(found.getSupportedResponseTypes().isEmpty());
122122
assertNotNull(found.getAccessPolicy());
123123
assertNotNull(found.getAuthPolicy());
124+
assertNotNull(found.getAccessTokenMaxTimeToLive());
124125
}
125126

126127
@Test
@@ -147,13 +148,15 @@ public void updateOIDCRP() {
147148

148149
oidcrpTO.setClientId("newClientId");
149150
oidcrpTO.setAccessPolicy(accessPolicyTO.getKey());
151+
oidcrpTO.setDeviceTokenTimeToKill("PT6M");
150152

151153
CLIENT_APP_SERVICE.update(ClientAppType.OIDCRP, oidcrpTO);
152154
OIDCRPClientAppTO updated = CLIENT_APP_SERVICE.read(ClientAppType.OIDCRP, oidcrpTO.getKey());
153155

154156
assertNotNull(updated);
155157
assertEquals("newClientId", updated.getClientId());
156158
assertNotNull(updated.getAccessPolicy());
159+
assertEquals("PT6M", updated.getDeviceTokenTimeToKill());
157160
}
158161

159162
@Test

0 commit comments

Comments
 (0)