Package net.shibboleth.oidc.security.jwt.claims.impl

Class AuthenticationTimeClaimsValidator

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • authnLifetimeLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​Duration> authnLifetimeLookupStrategy
        Lookup strategy to find the amount of time for which a token is valid after if it was first issued. (Default value: 60 seconds)

      • authnRequestTimeLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​Instant> authnRequestTimeLookupStrategy
        Lookup strategy to find the time at which the authentication request was made. Defaults to now minus the clockskew.

      • clockSkew

        @Nonnull
private Duration clockSkew
        Positive clock skew adjustment to consider when checking auth_time is not in the future or has expired. (Default value: 60 seconds).

      • requested

        @Nonnull
private Predicate<ProfileRequestContext> requested
        Has the auth_time been requested, either explicitly or from the max_age parameter? Defaults to true.

    • Constructor Detail

      • AuthenticationTimeClaimsValidator

        public AuthenticationTimeClaimsValidator()
        Constructor.

    • Method Detail

      • setClockSkew

        public void setClockSkew​(@Nonnull
                         Duration skew)
        Set the clock skew.
        Parameters:
        skew - clock skew to set

      • setAuthnRequestTimeLookupStrategy

        public void setAuthnRequestTimeLookupStrategy​(Function<ProfileRequestContext,​Instant> strategy)
        Set the lookup strategy to find out when the authentication request (if any) was made.
        Parameters:
        strategy - the strategy
        Since:
        2.2.0

      • setRequested

        @Deprecated(forRemoval=true,
            since="2.2.0")
public void setRequested​(Predicate<ProfileRequestContext> isRequested)
        Deprecated, for removal: This API element is subject to removal in a future version.
        use the activation condition in the base class instead.
        Has the auth_time been request e.g. explicitly, or by using the max_age parameter.
        Parameters:
        isRequested - has auth_time been requested.

      • setAuthnLifetime

        public void setAuthnLifetime​(@Nonnull
                             Duration lifetime)
        Sets the amount of time for which a token is valid from when the original authentication took place.
        Parameters:
        lifetime - amount of time for which a token is valid

      • setAuthnLifetimeLookupStrategy

        public void setAuthnLifetimeLookupStrategy​(@Nonnull
                                           Function<ProfileRequestContext,​Duration> strategy)
        Set the lookup strategy used to locate the amount of time for which a token is valid from when the original authentication took place.
        Parameters:
        strategy - the strategy
        Since:
        2.2.0