search

WrenSecurity / wrenam

Community fork of OpenAM, an authentication and authorization system originally developed by ForgeRock.
Other
43 stars 27 forks source link

Handle token validity maximum value. #140

Closed karelmaxa closed 1 year ago

karelmaxa commented 1 year ago

This PR introduces the maximum allowed validity for tokens stored in CTS. Agent tokens currently use the Long.MAX_VALUE value, but the Wren:DS GeneralizedTime component fails to parse it (see stacktrace bellow).

java.util.concurrent.ExecutionException: org.forgerock.i18n.LocalizedIllegalArgumentException: The provided value "2922690551202174704.192+0100" is not a valid generalized time value because "69" is not a valid month specification
    at java.base/java.util.concurrent.FutureTask.report(FutureTask.java:122)
    at java.base/java.util.concurrent.FutureTask.get(FutureTask.java:191)
    at org.forgerock.openam.shared.concurrency.ThreadMonitor$WatchDog.run(ThreadMonitor.java:294)
    at org.forgerock.openam.audit.context.AuditRequestContextPropagatingRunnable.run(AuditRequestContextPropagatingRunnable.java:42)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
    at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: org.forgerock.i18n.LocalizedIllegalArgumentException: The provided value "2922690551202174704.192+0100" is not a valid generalized time value because "69" is not a valid month specification
    at org.forgerock.opendj.ldap.GeneralizedTime.valueOf(GeneralizedTime.java:221)
    at org.forgerock.openam.cts.api.tokens.Token.get(Token.java:349)
    at org.forgerock.openam.cts.api.tokens.Token.getAttribute(Token.java:198)
    at org.forgerock.openam.cts.utils.LdapTokenAttributeConversion.getEntry(LdapTokenAttributeConversion.java:96)
    at org.forgerock.openam.cts.impl.LdapAdapter.create(LdapAdapter.java:117)
    at org.forgerock.openam.sm.datalayer.impl.tasks.UpdateTask.performTask(UpdateTask.java:60)
    at org.forgerock.openam.sm.datalayer.api.AbstractTask.execute(AbstractTask.java:49)
    at org.forgerock.openam.sm.datalayer.impl.SeriesTaskExecutor$AuditRequestContextPropagatingTask.execute(SeriesTaskExecutor.java:217)
    at org.forgerock.openam.sm.datalayer.impl.SimpleTaskExecutor.execute(SimpleTaskExecutor.java:67)
    at org.forgerock.openam.sm.datalayer.impl.SeriesTaskExecutorThread.run(SeriesTaskExecutorThread.java:93)
    ... 6 more

I will create issue in Wren:DS to introduce GeneralizedTime maximum year validation.