Closed cezaryluksza closed 9 months ago
This is a tricky question: the JWT spec states that the JSON value in the token payload should be a NumericDate
(the number of seconds since January the 1st 1970 UTC), but there is nothing about the Java representation of the parsed JSON...
I am almost sure that Spring didn't map the value at the time the default OpaqueTokenAuthenticationConverter
was written (accessing the iat
claim was returning the number of seconds since EPOCH).
It would certainly be safer if this authentication converter was adapting to the type of value returned by the Java representation of the token claims.
The spec I link about JWTs is completely irrelevant: the introspected token can be in any format. What we are interested in is the format of the payload for the token introspection endpoint. But, according to this spec, the iat
should be an integer in the introspection response too.
Got it: the claims are altered in SpringOpaqueTokenIntrospector::convertClaimsSet
, which is private (among other things, Long
values with seconds since EPOCH are replaced with Instant
instances).
As each introspector implementation could have its own claim alteration rules, I'll have the default authentication converter accept Long
, Instant
and Date
values for exp
, iat
.
@cezaryluksza I just released a fix in 7.1.13
. Please confirm it solves your problem and close.
It works, thank you!
Hi
I decided to add token introspection to my resource server. I followed this tutorial: https://github.com/ch4mpy/spring-addons/blob/spring-addons-7.1.8/samples/tutorials/resource-server_with_introspection/README.md
And I'm getting this exception in introspectionAuthenticationConverter():
Attributes from my token: iat -> {Instant@22266} "2023-11-06T10:48:02Z" exp -> {Instant@22264} "2023-11-06T20:48:00Z"
I use keycloak token introspection endpoint.
Expected behavior I think converter shouldn't assume that these attributes are castable to integers, but please correct me if I'm wrong.
Sample token JSON payload after anonymization (generated random UUID):