Could you please check the new (Java 8 based) implementation of
TicketGrantingTicketExpirationPolicy.isExpired?
To my opinion the timeToKill check (sliding window) is not correct:
public boolean isExpired(final TicketState ticketState) {
final ZonedDateTime currentSystemTime = ZonedDateTime.now(ZoneOffset
.UTC);
final ZonedDateTime creationTime = ticketState.getCreationTime();
// Ticket has been used, check maxTimeToLive (hard window)
// ...
// Ticket is within hard window, check timeToKill (sliding window)
expirationTime = creationTime.plus(this.timeToKillInMilliSeconds,
ChronoUnit.MILLIS);
if (ticketState.getLastTimeUsed().isAfter(expirationTime)) {
LOGGER.debug("Ticket is expired because the time since last use
is greater than timeToKillInMilliseconds");
return true;
}
return false;
}
Looking at the 4.2.2 implementation it should be something like this
public boolean isExpired(final TicketState ticketState) {
final ZonedDateTime currentSystemTime = ZonedDateTime.now(ZoneOffset
.UTC);
final ZonedDateTime creationTime = ticketState.getCreationTime();
// ...
/* 4.2.2
final long currentSystemTimeInMillis = System.currentTimeMillis();
...
// Ticket is within hard window, check timeToKill (sliding window)
if (currentSystemTimeInMillis - ticketState.getLastTimeUsed() >=
timeToKillInMilliSeconds) {
LOGGER.debug("Ticket is expired because the time since last use
is greater than timeToKillInMilliseconds");
return true;
}
*/
// Ticket is within hard window, check timeToKill (sliding window)
expirationTime = ticketState.getLastTimeUsed().plus(this.
timeToKillInMilliSeconds, ChronoUnit.MILLIS);
if (currentSystemTime.isAfter(expirationTime)) {
LOGGER.debug("Ticket is expired because the time since last use
is greater than timeToKillInMilliseconds");
return true;
}
return false;
}
Thx!
Best regards
Axel
--
CAS gitter chatroom: https://gitter.im/apereo/cas
CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
CAS documentation website: https://apereo.github.io/cas
CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/1ecb8a15-d8ff-4283-9eee-1ad7ba2da2aa%40apereo.org.
For more options, visit https://groups.google.com/a/apereo.org/d/optout.
