-
Notifications
You must be signed in to change notification settings - Fork 6k
OidcAuthorizationCodeAuthenticationProvider maxIssuedAt #5189
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
My sugestion |
@marcosjunqueira I cannot reproduce the issue you are having. I've tested google login numerous times and never had this issue. Looking at those times:
Looks like the clock is not in sync with Google time or Global time. Try adjusting the time on the computer where you are testing. I think that will do it. |
Hi @jgrandja I tried to config the Google NTP, but aparently it doesn't sync secs (strange behavior). If i adjust seconds manualy it works.
Thinking about this definition, would not it be interesting to restrict this time both before and after the server's current time? For example, if you stay in debug mode for 10 minutes before the system obtains the current time, it will allow authentication. And 10 minutes, for me, is too far away from current time. |
sync time with time.google.com and got this
Set the time manually (plus 30 secs), and it worked. |
Our primary goal is to be spec compliant and therefore we've implemented this validation check as documented in ID Token Validation.
Sitting in debug mode is not a real-world scenario. When an OpenID Connect flow is triggered it happens fairly quickly - it will not take 10 mins to complete...more like a few seconds. If it took longer than 30 seconds, for example, than likely a Network I/O error will occur and login will fail anyway at which point the ID Token would never have been received by the client. I'm going to close this issue as you seemed to have resolved the clock sync issue. Thank you for your feedback! |
Summary
When I config oauth2 for google and login, get an invalid_id_token exception.
Actual Behavior
So I decided to debug, but on debug mode it works.
Expected Behavior
Success login with google without debug.
Configuration
security:
oauth2:
client:
registration:
google:
client-id: {client_id}
client-secret: {secret_id}
Version
5.0.3.RELEASE
Sample fail
Instant maxIssuedAt = Instant.now().plusSeconds(30);
if (issuedAt.isAfter(maxIssuedAt)) {
// breakpoint here --> this.throwInvalidIdTokenException();
}
issuedAt = 2018-03-30T22:13:07Z
maxIssuedAt = 2018-03-30T22:13:05.302Z
Sample works
// breakpoint here and wait -->Instant maxIssuedAt = Instant.now().plusSeconds(30);
if (issuedAt.isAfter(maxIssuedAt)) {
this.throwInvalidIdTokenException();
}
issuedAt = 2018-03-30T22:16:22Z
maxIssuedAt = 2018-03-30T22:16:27.326Z
and successfull login
The text was updated successfully, but these errors were encountered: