sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #5077 from wkloucek/lower-default-idp-lifespans

Browse Source 
lower default access / id / refresh token lifespans
This commit is contained in:
Michael Barz
2022-11-21 14:50:25 +01:00
committed by GitHub
parent 7da519aa12 018cc5b9f5
commit f3667b1e24
3 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changelog/unreleased/change-lower-idp-token-lifespans.md
+5
View File
@@ -0,0 +1,5 @@
Bugfix: Lower IDP token lifespans
We've lowered the IDP token lifespans to more reasonable durations.
https://github.com/owncloud/ocis/pull/5077
services/idp/pkg/config/config.go
+4 -4
View File
@@ -111,8 +111,8 @@ type Settings struct {
CookieBackendURI string
CookieNames []string
AccessTokenDurationSeconds uint64 `yaml:"access_token_duration_seconds" env:"IDP_ACCESS_TOKEN_EXPIRATION" desc:"Expiration time in seconds for IDP access token."`
IDTokenDurationSeconds uint64 `yaml:"id_token_duration_seconds" env:"IDP_ID_TOKEN_EXPIRATION" desc:"Expiration time in seconds for IDP ID tokens."`
RefreshTokenDurationSeconds uint64 `yaml:"refresh_token_duration_seconds" env:"IDP_REFRESH_TOKEN_EXPIRATION" desc:"Expiration time in seconds for refresh tokens."`
DyamicClientSecretDurationSeconds uint64 `yaml:"dynamic_client_secret_duration_seconds" env:"IDP_DYNAMIC_CLIENT_SECRET_DURATION" desc:"Expiration time in seconds for dynamic clients."`
AccessTokenDurationSeconds uint64 `yaml:"access_token_duration_seconds" env:"IDP_ACCESS_TOKEN_EXPIRATION" desc:"'Access token lifespan in seconds (time before an access token is expired).'"`
IDTokenDurationSeconds uint64 `yaml:"id_token_duration_seconds" env:"IDP_ID_TOKEN_EXPIRATION" desc:"ID token lifespan in seconds (time before an ID token is expired)."`
RefreshTokenDurationSeconds uint64 `yaml:"refresh_token_duration_seconds" env:"IDP_REFRESH_TOKEN_EXPIRATION" desc:"Refresh token lifespan in seconds (time before an refresh token is expired). This also limits the duration of an idle offline session."`
DyamicClientSecretDurationSeconds uint64 `yaml:"dynamic_client_secret_duration_seconds" env:"IDP_DYNAMIC_CLIENT_SECRET_DURATION" desc:"Lifespan in seconds of a dynamically registered OIDC client."`
}
services/idp/pkg/config/defaults/defaultconfig.go
+3 -3
View File
@@ -61,9 +61,9 @@ func DefaultConfig() *config.Config {
ValidationKeysPath: "",
CookieBackendURI: "",
CookieNames: nil,
AccessTokenDurationSeconds: 60 * 60 * 24, // 1 day
IDTokenDurationSeconds: 60 * 60, // 1 hour
RefreshTokenDurationSeconds: 60 * 60 * 24 * 365 * 3, // 1 year
AccessTokenDurationSeconds: 60 * 5, // 5 minutes
IDTokenDurationSeconds: 60 * 5, // 5 minutes
RefreshTokenDurationSeconds: 60 * 60 * 24 * 30, // 30 days
DyamicClientSecretDurationSeconds: 0,
},
Clients: []config.Client{