Merge pull request jenkinsci#24 from iwarapter/token-lifetime

Allow id token lifetime to be configurable

src/main/java/io/jenkins/plugins/oidc_provider/IdTokenCredentials.java

@@ -51,6 +51,7 @@
 import java.security.interfaces.RSAPublicKey;
 import java.security.spec.PKCS8EncodedKeySpec;
 import java.security.spec.RSAPublicKeySpec;
+import java.time.Instant;
 import java.time.temporal.ChronoUnit;
 import java.util.Arrays;
 import java.util.Base64;
@@ -181,11 +182,12 @@ RSAPublicKey publicKey() {
  )));
 
  protected final @NonNull String token() {
+ IdTokenConfiguration cfg = IdTokenConfiguration.get();
  JwtBuilder builder = Jwts.builder().
  setHeaderParam("kid", getId()).
  setIssuer(issuer != null ? issuer : findIssuer().url()).
  setAudience(audience).
- setExpiration(Date.from(new Date().toInstant().plus(1, ChronoUnit.HOURS))).
+ setExpiration(Date.from(Instant.now().plus(cfg.getTokenLifetime(), ChronoUnit.SECONDS))).
  setIssuedAt(new Date());
  Map<String, String> env;
  if (build != null) {
@@ -198,7 +200,6 @@ RSAPublicKey publicKey() {
  // EnvVars.masterEnvVars might not be safe to expose
  env = Collections.singletonMap("JENKINS_URL", Jenkins.get().getRootUrl());
  }
- IdTokenConfiguration cfg = IdTokenConfiguration.get();
  AtomicBoolean definedSub = new AtomicBoolean();
  Consumer<List<ClaimTemplate>> addClaims = claimTemplates -> {
  for (ClaimTemplate t : claimTemplates) {

src/main/java/io/jenkins/plugins/oidc_provider/config/IdTokenConfiguration.java

@@ -57,6 +57,8 @@
  return ExtensionList.lookupSingleton(IdTokenConfiguration.class);
  }
 
+ private int tokenLifetime = 3600;
+
  private @CheckForNull List<ClaimTemplate> claimTemplates;
  private @CheckForNull List<ClaimTemplate> buildClaimTemplates;
  private @CheckForNull List<ClaimTemplate> globalClaimTemplates;
@@ -80,6 +82,14 @@ public IdTokenConfiguration() {
  }
  }
 
+ public int getTokenLifetime() {
+ return tokenLifetime;
+ }
+
+ @DataBoundSetter public void setTokenLifetime(final int lifetime) {
+ this.tokenLifetime = lifetime;
+ }
+
  public @NonNull List<ClaimTemplate> getClaimTemplates() {
  return claimTemplates != null ? claimTemplates : DEFAULT_CLAIM_TEMPLATES;
  }

src/main/resources/io/jenkins/plugins/oidc_provider/config/IdTokenConfiguration/config.jelly

@@ -26,6 +26,10 @@ THE SOFTWARE.
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:f="/lib/form">
  <f:section title="OpenID Connect">
+ <f:entry field="tokenLifetime" title="${%Token Lifetime}">
+ <f:number clazz="positive-number-required"/>
+ </f:entry>
+
  <f:advanced title="${%Claim templates}" align="left">
  <f:entry field="claimTemplates" title="${%General claim templates}">
  <f:repeatableProperty field="claimTemplates">

src/main/resources/io/jenkins/plugins/oidc_provider/config/IdTokenConfiguration/help-tokenLifetime.html

@@ -0,0 +1,3 @@
+<div>
+ The time in seconds the issued id_token is valid for.
+</div>

src/test/java/io/jenkins/plugins/oidc_provider/ConfigurationAsCodeTest.java

@@ -59,6 +59,7 @@ public class ConfigurationAsCodeTest {
  @ConfiguredWithCode("global.yaml")
  @Test public void globalConfiguration() throws Exception {
  IdTokenConfiguration cfg = IdTokenConfiguration.get();
+ assertEquals(60, cfg.getTokenLifetime());
  assertEquals(ClaimTemplate.xmlForm(Collections.singletonList(new ClaimTemplate("ok", "true", new BooleanClaimType()))),
  ClaimTemplate.xmlForm(cfg.getClaimTemplates()));
  assertEquals(ClaimTemplate.xmlForm(Collections.singletonList(new ClaimTemplate("sub", "jenkins", new StringClaimType()))),

src/test/java/io/jenkins/plugins/oidc_provider/IdTokenCredentialsTest.java

@@ -40,6 +40,8 @@
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.Jwts;
 import java.math.BigInteger;
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
@@ -132,6 +134,24 @@ public class IdTokenCredentialsTest {
  });
  }
 
+ @Test public void tokenLifetime() throws Throwable {
+ rr.then(r -> {
+ IdTokenStringCredentials c = new IdTokenStringCredentials(CredentialsScope.GLOBAL, "test", null);
+ CredentialsProvider.lookupStores(r.jenkins).iterator().next().addCredentials(Domain.global(), c);
+ IdTokenConfiguration cfg = IdTokenConfiguration.get();
+ cfg.setTokenLifetime(60);
+ String idToken = c.getSecret().getPlainText();
+ System.out.println(idToken);
+ Claims claims = Jwts.parserBuilder().
+ setSigningKey(c.publicKey()).
+ build().
+ parseClaimsJws(idToken).
+ getBody();
+
+ assertTrue(Instant.now().plus(61, ChronoUnit.SECONDS).isAfter(claims.getExpiration().toInstant()));
+ });
+ }
+
  @Test public void customClaims() throws Throwable {
  rr.then(r -> {
  IdTokenStringCredentials c = new IdTokenStringCredentials(CredentialsScope.GLOBAL, "test", null);

src/test/resources/io/jenkins/plugins/oidc_provider/global.yaml

@@ -1,5 +1,6 @@
 security:
  idToken:
+ tokenLifetime: 60
  claimTemplates:
  - name: ok
  format: "true"