amarkevich commented on a change in pull request #645: CXF-8222 OIDC Refresh
Response: ID Token iat Claim MUST represent the time that the new ID Token is
issued
URL: https://github.com/apache/cxf/pull/645#discussion_r386376623
##########
File path:
rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
##########
@@ -78,7 +78,12 @@ private String getProcessedIdToken(ServerAccessToken st) {
idToken.setAudience(st.getClient().getClientId());
idToken.setAuthorizedParty(st.getClient().getClientId());
// if this token was refreshed then the cloned IDToken might
need to have its
- // issuedAt and expiry time properties adjusted if it proves
to be necessary
+ // issuedAt and expiry time properties adjusted
+ if (null == st.getResponseType()) {
+ final Long iat = st.getIssuedAt();
+ idToken.setExpiryTime(iat + (idToken.getExpiryTime() -
idToken.getIssuedAt()));
+ idToken.setIssuedAt(iat);
+ }
Review comment:
`st.getResponseType() == null` in case of request with param
`grant_type=refresh_token`
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
