You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2019/05/10 11:50:36 UTC
[cxf] branch 3.2.x-fixes updated (9cbccb6 -> be5d776)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git.
from 9cbccb6 Recording .gitmergeinfo Changes
new ceccf49 Update JwtAccessTokenValidator.java
new 6316bc6 Removed unused import
new be5d776 Fixing issued at time
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../rs/security/oauth2/filters/AccessTokenIntrospectionClient.java | 5 ++---
.../cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java | 5 ++---
2 files changed, 4 insertions(+), 6 deletions(-)
[cxf] 01/03: Update JwtAccessTokenValidator.java
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit ceccf493cbf825901cee378b536582cd86e21440
Author: onlinenguyen <50...@users.noreply.github.com>
AuthorDate: Thu May 9 14:56:05 2019 -0500
Update JwtAccessTokenValidator.java
The token lifetime is incorrectly calculated to a negative value because claims expiry time is in second interval and original code is setting issued at value in millisecond interval.
(cherry picked from commit a5eb0da294d5134ac5bb9c9767c6324141eefe20)
---
.../cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java
index a7c8717..68a3531 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java
@@ -41,6 +41,7 @@ import org.apache.cxf.rs.security.oauth2.provider.AccessTokenValidator;
import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
import org.apache.cxf.rs.security.oauth2.utils.JwtTokenUtils;
import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
public class JwtAccessTokenValidator extends JoseJwtConsumer implements AccessTokenValidator {
@@ -76,8 +77,7 @@ public class JwtAccessTokenValidator extends JoseJwtConsumer implements AccessTo
if (claims.getIssuedAt() != null) {
atv.setTokenIssuedAt(claims.getIssuedAt());
} else {
- Instant now = Instant.now();
- atv.setTokenIssuedAt(now.toEpochMilli());
+ atv.setTokenIssuedAt(OAuthUtils.getIssuedAt());
}
if (claims.getExpiryTime() != null) {
atv.setTokenLifetime(claims.getExpiryTime() - atv.getTokenIssuedAt());
[cxf] 02/03: Removed unused import
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 6316bc6ef974085db77e980b51fd6df748040beb
Author: onlinenguyen <50...@users.noreply.github.com>
AuthorDate: Thu May 9 20:31:46 2019 -0500
Removed unused import
(cherry picked from commit e2eb6a7c4bcf905d387aed54b2ff158842f06b27)
---
.../apache/cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java | 1 -
1 file changed, 1 deletion(-)
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java
index 68a3531..01af360 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/JwtAccessTokenValidator.java
@@ -18,7 +18,6 @@
*/
package org.apache.cxf.rs.security.oauth2.filters;
-import java.time.Instant;
import java.util.Collections;
import java.util.LinkedList;
import java.util.List;
[cxf] 03/03: Fixing issued at time
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit be5d7761df4b6927b2c39d9d13410ffa8ba5cd72
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri May 10 12:38:30 2019 +0100
Fixing issued at time
(cherry picked from commit 154a72b8a530ccfcddcc7ac0cd6380efa628e068)
---
.../rs/security/oauth2/filters/AccessTokenIntrospectionClient.java | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/AccessTokenIntrospectionClient.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/AccessTokenIntrospectionClient.java
index 2c78938..2b4d549 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/AccessTokenIntrospectionClient.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/AccessTokenIntrospectionClient.java
@@ -18,7 +18,6 @@
*/
package org.apache.cxf.rs.security.oauth2.filters;
-import java.time.Instant;
import java.util.Collections;
import java.util.LinkedList;
import java.util.List;
@@ -37,6 +36,7 @@ import org.apache.cxf.rs.security.oauth2.common.UserSubject;
import org.apache.cxf.rs.security.oauth2.provider.AccessTokenValidator;
import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
public class AccessTokenIntrospectionClient implements AccessTokenValidator {
@@ -70,8 +70,7 @@ public class AccessTokenIntrospectionClient implements AccessTokenValidator {
if (response.getIat() != null) {
atv.setTokenIssuedAt(response.getIat());
} else {
- Instant now = Instant.now();
- atv.setTokenIssuedAt(now.toEpochMilli());
+ atv.setTokenIssuedAt(OAuthUtils.getIssuedAt());
}
if (response.getExp() != null) {
atv.setTokenLifetime(response.getExp() - atv.getTokenIssuedAt());