1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
// Copyright 2025 OpenPubkey
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// SPDX-License-Identifier: Apache-2.0
package verifier
import (
"fmt"
"time"
"github.com/openpubkey/openpubkey/oidc"
"github.com/openpubkey/openpubkey/pktoken"
)
type ExpirationPolicy struct {
maxAge time.Duration
checkMaxAge bool
checkExpClaim bool
checkRefreshed bool
}
var ExpirationPolicies = struct {
OIDC ExpirationPolicy // This uses the OpenID Connect expiration claim
OIDC_REFRESHED ExpirationPolicy // This uses the OpenID Connect expiration claim on the ID Token, if that has expired. It checks the expiration on the refreshed ID Token, a.k.a., the fresh ID Token
MAX_AGE_12HOURS ExpirationPolicy // This replaces the OpenID Connect expiration claim with OpenPubkey 12 expiration
MAX_AGE_24HOURS ExpirationPolicy
MAX_AGE_48HOURS ExpirationPolicy
MAX_AGE_1WEEK ExpirationPolicy
NEVER_EXPIRE ExpirationPolicy // ID Token will never expire until the OpenID Provider rotates the ID Token
}{
OIDC: ExpirationPolicy{maxAge: 0, checkMaxAge: false, checkExpClaim: true},
OIDC_REFRESHED: ExpirationPolicy{maxAge: 0, checkMaxAge: false, checkExpClaim: false, checkRefreshed: true},
MAX_AGE_12HOURS: ExpirationPolicy{maxAge: 12 * time.Hour, checkMaxAge: true, checkExpClaim: false},
MAX_AGE_24HOURS: ExpirationPolicy{maxAge: 24 * time.Hour, checkMaxAge: true, checkExpClaim: false},
MAX_AGE_48HOURS: ExpirationPolicy{maxAge: 2 * 24 * time.Hour, checkMaxAge: true, checkExpClaim: false},
MAX_AGE_1WEEK: ExpirationPolicy{maxAge: 7 * 24 * time.Hour, checkMaxAge: true, checkExpClaim: false},
NEVER_EXPIRE: ExpirationPolicy{maxAge: 0, checkMaxAge: false, checkExpClaim: false},
}
// CheckExpiration checks the expiration of the PK Token against the expiration
// policy.
func (ep ExpirationPolicy) CheckExpiration(pkt *pktoken.PKToken) error {
idt, err := oidc.NewJwt(pkt.OpToken)
if err != nil {
return err
}
idtClaims := idt.GetClaims()
if ep.checkExpClaim {
_, err := verifyNotExpired(idtClaims.Expiration)
if err != nil {
return err
}
}
if ep.checkRefreshed {
expired, err := verifyNotExpired(idtClaims.Expiration)
// If the id token is expired, verify against the refreshed id token
if expired {
if pkt.FreshIDToken == nil {
return fmt.Errorf("ID token is expired and no refresh token found")
}
freshIdt, err := oidc.NewJwt(pkt.FreshIDToken)
if err != nil {
return err
}
_, err = verifyNotExpired(freshIdt.GetClaims().Expiration)
if err != nil {
return err
}
} else if err != nil { // an non-expiration error occurred
return err
}
}
if ep.checkMaxAge {
_, err := checkMaxAge(idtClaims.IssuedAt, int64(ep.maxAge.Seconds()))
if err != nil {
return err
}
}
return nil
}
// verifyNotExpired checks the expiration of the ID Token using the exp claim.
// If expired, returns true and set an error. If an error prevents checking
// expiration it return false and the error.
func verifyNotExpired(expiration int64) (bool, error) {
if expiration == 0 {
return false, fmt.Errorf("missing expiration claim")
}
if expiration < 0 {
return false, fmt.Errorf("expiration must be must be greater than zero (issuedAt = %v)", expiration)
}
// JWT expiration is "Seconds Since the Epoch"
// RFC-7519 -Section 2 https://www.rfc-editor.org/rfc/rfc7519#section-2
expirationTime := time.Unix(expiration, 0)
if time.Now().After(expirationTime) {
return true, fmt.Errorf("the ID token has expired (exp = %v)", expiration)
}
return false, nil
}
// checkMaxAge checks the max age of the ID Token using the issuedAt claim.
// If expired, returns true and set an error. If an error prevents checking
// expiration it return false and the error.
func checkMaxAge(issuedAt int64, maxAge int64) (bool, error) {
if issuedAt == 0 {
return false, fmt.Errorf("missing issuedAt claim")
}
if issuedAt < 0 {
return false, fmt.Errorf("issuedAt must be must be greater than zero (issuedAt = %v)", issuedAt)
}
if !(maxAge > 0) {
return false, fmt.Errorf("maxAge configuration must be greater than zero (maxAge = %v)", maxAge)
}
// Ensure we throw an error is something goes wrong and we get parameters so large they overflow
if (issuedAt + maxAge) < issuedAt {
return false, fmt.Errorf("invalid values (issuedAt = %v, maxAge = %v)", issuedAt, maxAge)
}
expirationTime := time.Unix(issuedAt+maxAge, 0)
if time.Now().After(expirationTime) {
return true, fmt.Errorf("the PK token has expired based on maxAge (issuedAt = %v, maxAge = %v, expiratedAt = %v)", issuedAt, maxAge, expirationTime)
}
return false, nil
}
|
