jenkinsci / oic-auth-plugin

A Jenkins plugin which lets you login to Jenkins using your own, self-hosted or public openid connect server.
https://plugins.jenkins.io/oic-auth
MIT License
71 stars 88 forks source link

Fix calculation of expiration timestamp #359

Closed mprausa closed 2 weeks ago

mprausa commented 1 month ago

currentTimestamp is in millis already which is why it should not be mulitplied by 1000.

The constructor of OicCredentials is called with CLOCK.millis() (here and here) for the currentTimestamp parameter which shows that currentTimestamp is indeed in millis and not seconds.

This bug was introduced in bba32e09 (PR #357).

Testing done

Submitter checklist

codecov[bot] commented 1 month ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 71.44%. Comparing base (b7205f1) to head (8e99549). Report is 6 commits behind head on master.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #359 +/- ## ============================================ - Coverage 72.02% 71.44% -0.58% + Complexity 234 232 -2 ============================================ Files 11 11 Lines 990 991 +1 Branches 142 142 ============================================ - Hits 713 708 -5 - Misses 199 205 +6 Partials 78 78 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

mprausa commented 1 month ago

I've added a second commit. I think the other change on the same line done in PR #357 is incorrect as well. We have to subtract allowedClockSkewFixed, so that the token is refreshed earlier not later.

mprausa commented 2 weeks ago

@michael-doubez Yes, I agree. I've removed the second commit.