Skip to content

OidcAuthorizationCodeAuthenticationProvider maxIssuedAt #5189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
marcosjunqueira opened this issue Mar 30, 2018 · 5 comments
Closed

OidcAuthorizationCodeAuthenticationProvider maxIssuedAt #5189

marcosjunqueira opened this issue Mar 30, 2018 · 5 comments
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

Comments

@marcosjunqueira
Copy link

Summary

When I config oauth2 for google and login, get an invalid_id_token exception.

Actual Behavior

So I decided to debug, but on debug mode it works.

Expected Behavior

Success login with google without debug.

Configuration

security:
oauth2:
client:
registration:
google:
client-id: {client_id}
client-secret: {secret_id}

Version

5.0.3.RELEASE

Sample fail

Instant maxIssuedAt = Instant.now().plusSeconds(30);
if (issuedAt.isAfter(maxIssuedAt)) {
// breakpoint here --> this.throwInvalidIdTokenException();
}

issuedAt = 2018-03-30T22:13:07Z
maxIssuedAt = 2018-03-30T22:13:05.302Z

Sample works

// breakpoint here and wait -->Instant maxIssuedAt = Instant.now().plusSeconds(30);
if (issuedAt.isAfter(maxIssuedAt)) {
this.throwInvalidIdTokenException();
}

issuedAt = 2018-03-30T22:16:22Z
maxIssuedAt = 2018-03-30T22:16:27.326Z
and successfull login

@marcosjunqueira
Copy link
Author

marcosjunqueira commented Mar 31, 2018

My sugestion
if (Math.abs(maxIssuedAt.until(issuedAt, ChronoUnit.SECONDS)) > 30) {
this.throwInvalidIdTokenException();
}

@jgrandja jgrandja added the in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) label Apr 2, 2018
@jgrandja jgrandja self-assigned this Apr 4, 2018
@jgrandja
Copy link
Contributor

jgrandja commented Apr 4, 2018

@marcosjunqueira I cannot reproduce the issue you are having. I've tested google login numerous times and never had this issue.

Looking at those times:

issuedAt -> 2018-03-30T22:13:07Z
maxIssuedAt -> 2018-03-30T22:13:05.302Z

issuedAt is what comes back from Google and it's 10:13pm 7 secs.

maxIssuedAt is calculated as current-time + 30 secs so if the clocks are in sync with Google and the computer where you are testing than the time would be approx. 10:13pm 37 secs. However, the time you have there is 10:13pm 5 secs, which is behind the issuedAt time.

Looks like the clock is not in sync with Google time or Global time. Try adjusting the time on the computer where you are testing. I think that will do it.

@jgrandja jgrandja added the status: waiting-for-feedback We need additional information before we can continue label Apr 4, 2018
@marcosjunqueira
Copy link
Author

Hi @jgrandja I tried to config the Google NTP, but aparently it doesn't sync secs (strange behavior). If i adjust seconds manualy it works.

  1. The iat Claim can be used to reject tokens that were issued too far away from the current time...

Thinking about this definition, would not it be interesting to restrict this time both before and after the server's current time?

For example, if you stay in debug mode for 10 minutes before the system obtains the current time, it will allow authentication. And 10 minutes, for me, is too far away from current time.

@marcosjunqueira
Copy link
Author

marcosjunqueira commented Apr 4, 2018

sync time with time.google.com and got this

Instant.now() = 2018-04-04T22:18:25.513Z
maxIssuedAt = 2018-04-04T22:18:55.513Z
issuedAt = 2018-04-04T22:19:02Z

Set the time manually (plus 30 secs), and it worked.

@jgrandja
Copy link
Contributor

jgrandja commented Apr 6, 2018

@marcosjunqueira

Thinking about this definition, would not it be interesting to restrict this time both before and after the server's current time?

Our primary goal is to be spec compliant and therefore we've implemented this validation check as documented in ID Token Validation.

For example, if you stay in debug mode for 10 minutes before the system obtains the current time, it will allow authentication. And 10 minutes, for me, is too far away from current time.

Sitting in debug mode is not a real-world scenario. When an OpenID Connect flow is triggered it happens fairly quickly - it will not take 10 mins to complete...more like a few seconds. If it took longer than 30 seconds, for example, than likely a Network I/O error will occur and login will fail anyway at which point the ID Token would never have been received by the client.

I'm going to close this issue as you seemed to have resolved the clock sync issue.

Thank you for your feedback!

@jgrandja jgrandja closed this as completed Apr 6, 2018
@jgrandja jgrandja removed the status: waiting-for-feedback We need additional information before we can continue label Apr 6, 2018
@jgrandja jgrandja removed their assignment Apr 6, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)
Projects
None yet
Development

No branches or pull requests

2 participants