Replace OidcTokenValidator with OAuth2TokenValidator implementation #5930
Labels
in: oauth2
An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)
type: enhancement
A general enhancement
Milestone
We should extract the logic in
OidcTokenValidator.validateIdToken()
into a new implementation ofOAuth2TokenValidator
namedOidcIdTokenValidator
.The
OidcIdTokenValidator
instance would than be composed in the requiredJwtDecoder
, for example,NimbusJwtDecoderJwkSupport
andNimbusReactiveJwtDecoder
.The classes that would need to be changed are
OidcAuthorizationCodeAuthenticationProvider
andOidcAuthorizationCodeReactiveAuthenticationManager
.We should also consider exposing
OidcIdTokenValidator.setIssuedAtSkew(Duration issuedAtSkew)
that would allow for a configurablemaxIssuedAt
, which is currently hard-coded at 30 secs.The text was updated successfully, but these errors were encountered: