Skip to content

Replace OidcTokenValidator with OAuth2TokenValidator implementation #5930

Closed
@jgrandja

Description

@jgrandja

We should extract the logic in OidcTokenValidator.validateIdToken() into a new implementation of OAuth2TokenValidator named OidcIdTokenValidator.

The OidcIdTokenValidator instance would than be composed in the required JwtDecoder, for example, NimbusJwtDecoderJwkSupport and NimbusReactiveJwtDecoder.

The classes that would need to be changed are OidcAuthorizationCodeAuthenticationProvider and OidcAuthorizationCodeReactiveAuthenticationManager.

We should also consider exposing OidcIdTokenValidator.setIssuedAtSkew(Duration issuedAtSkew) that would allow for a configurable maxIssuedAt, which is currently hard-coded at 30 secs.

Metadata

Metadata

Assignees

Labels

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)type: enhancementA general enhancement

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions