[GitHub] [cxf] coheigea commented on a change in pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued

[GitBox <gi...@apache.org>]

coheigea commented on a change in pull request #645: CXF-8222 OIDC Refresh Response: ID Token iat Claim MUST represent the time that the new ID Token is issued
URL: https://github.com/apache/cxf/pull/645#discussion_r386372736
 
 

 ##########
 File path: rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
 ##########
 @@ -78,7 +78,12 @@ private String getProcessedIdToken(ServerAccessToken st) {
                 idToken.setAudience(st.getClient().getClientId());
                 idToken.setAuthorizedParty(st.getClient().getClientId());
                 // if this token was refreshed then the cloned IDToken might need to have its
-                // issuedAt and expiry time properties adjusted if it proves to be necessary
+                // issuedAt and expiry time properties adjusted
+                if (null == st.getResponseType()) {
+                    final Long iat = st.getIssuedAt();
+                    idToken.setExpiryTime(iat + (idToken.getExpiryTime() - idToken.getIssuedAt()));
+                    idToken.setIssuedAt(iat);
+                }
 
 Review comment:
   Could you explain the logic here? Why set issued at / expiry only if st.getResponseType() is null?

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services