Description
Feature Request
Motivation
We use AppAuth on a released app, to provide authentication to its users.
Some users complain that they just cannot log in, and it often happens because they do not have their phones' clocks synchronizing automatically. They typically have a client time that is at least a little different from the authentication server's, and the AppAuth plugin returns an error.
Description
A parameter that would now be available for setting a more (or less) permissive allowed time for OpenID Connect Core Section 3.1.3.7 rules #9 and #10. e.g:
// OpenID Connect Core Section 3.1.3.7. rule #9
// Validates that the current time is before the expiry time.
Long allowedFutureSkewParam = null; // <-- this would come as a parameter
Long nowInSeconds = clock.getCurrentTimeMillis() / MILLIS_PER_SECOND;
// The next two lines would be modified
Long allowedFutureSkew = allowedFutureSkewParam != null ? allowedFutureSkewParam : 0L;
if (nowInSeconds - allowedFutureSkew > this.expiration) {
throw AuthorizationException.fromTemplate(GeneralErrors.ID_TOKEN_VALIDATION_ERROR,
new IdTokenException("ID Token expired"));
}
// OpenID Connect Core Section 3.1.3.7. rule #10
// Validates that the issued at time is not more than +/- 10 minutes on the current
// time.
Long allowedSkewParam = null; // <-- this would come as a parameter
// The next two lines would be modified
Long allowedSkew = allowedSkewParam != null ? allowedSkewParam : TEN_MINUTES_IN_SECONDS;
if (Math.abs(nowInSeconds - this.issuedAt) > allowedSkew) {
throw AuthorizationException.fromTemplate(GeneralErrors.ID_TOKEN_VALIDATION_ERROR,
new IdTokenException("Issued at time is more than 10 minutes "
+ "before or after the current time"));
}
One thing that is important to mention is that on OpenId's specs, the time is not determined, and in our case we wanted to make it a bit more permissive than TEN_MINUTES_IN_SECONDS.
It will not break anything as the default behavior would be to keep the current behavior.
The only drawback I can see here is maybe less security measures - but since this is an opt-in measure, we can assume that one that uses this knows what is being done.
Alternatives or Workarounds
We made this modification locally on a forked repo.
We wanted to know if a PR making this change would be accepted by the lib's maintainers and the community.