Uploaded image for project: 'CXF'
  1. CXF
  2. CXF-7806

Add option to create JWT access tokens without persisting them

    XMLWordPrintableJSON

Details

    • Task
    • Status: Closed
    • Major
    • Resolution: Fixed
    • None
    • 3.1.17, 3.2.7
    • None
    • None
    • Unknown

    Description

      Right now for the OAuth 2.0 data provider, we can issue access tokens in JWT format by specifying the "useJwtFormatForAccessTokens" property. However this persists the encoded JWT token, something that is problematic with the JPA provider as the Id column of the AccessToken class can't handle the size of the token.

      I propose to add a new property called "persistJwtEncoding" to be used in conjunction with "useJwtFormatForAccessTokens". By default "persistJwtEncoding" is true for backwards compatibility reasons.

      When "persistJwtEncoding" is false, then the AccessToken that is persisted just contains the Id (opaque String) as for the non-useJwtFormatForAccessTokens case. However, the JWT-encoded access token is returned to the client.

      For the AbstractAccessTokenValidator and the TokenIntrospectionService, we can also set "persistJwtEncoding" to false to validate and parse the received token into a JWTToken. The Id is then extracted from the token and used to retrieve the access token from storage.

      Attachments

        1. CXF-7806-RT.patch
          14 kB
          Colm O hEigeartaigh
        2. CXF-7806-RT-3.1.patch
          46 kB
          Colm O hEigeartaigh
        3. CXF-7806-systests.patch
          99 kB
          Colm O hEigeartaigh

        Activity

          People

            coheigea Colm O hEigeartaigh
            coheigea Colm O hEigeartaigh
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: