Fix Trust Mark Delegation validation to handle optional exp claim

[andreassolberg]

Summary

Fix validation step 7 for Trust Mark Delegation to correctly handle the optional exp claim.

Problem

The exp claim is defined as OPTIONAL in the Trust Mark Delegation JWT claims (Section 7.2.1):

exp: OPTIONAL. Number. Time when this delegation stops being valid. [...] If not present, it means that the delegation does not expire.

However, validation step 7 unconditionally required checking the exp claim:

The current time MUST be before the time represented by the exp (expiration) Claim in the delegation...

This is inconsistent - if exp is optional and "delegation does not expire" when absent, then the validation should only apply when exp is present.

Changes

Make validation step 7 conditional:

<!-- Before -->
<t>The current time MUST be before the time represented by the exp (expiration) 
Claim in the delegation (possibly allowing for some small leeway to account 
for clock skew).</t>

<!-- After -->
<t>If the <spanx style="verb">exp</spanx> (expiration) Claim is present in 
the delegation, the current time MUST be before the time it represents 
(possibly allowing for some small leeway to account for clock skew).</t>

References

• Section 7.2.1 - Trust Mark Delegation JWT (claims definition)
• Section 7.2.2 - Validating a Trust Mark Delegation (validation steps)

🤖 Generated with Claude Code

[selfissued]

This fix also applies to OpenID Federation 1.0.